Liquid Network says it temporarily paused its Bitcoin sidechain after purported "white-hat" hackers withdrew roughly $320 million in Bitcoin from its federation wallet, though the actors' int
Liquid Network says it temporarily paused its Bitcoin sidechain after purported "white-hat" hackers withdrew roughly $320 million in Bitcoin from its federation wallet, though the actors' intentions are disputed and blockchain records already show a large portion of the funds moving back toward a federation-linked address. The Liquid Network pause, first disclosed on September 6, 2026, remains only partially verified, and key details about scope, recovery and root cause are still unconfirmed.
KEY TAKEAWAYS
Liquid Network stated on September 6, 2026 that purported white-hat hackers had withdrawn approximately 4,000 BTC from its federation wallet, according to the project's official incident statement. The figure is the operator's own approximation, not an independently reconstructed reserve accounting. For related coverage, see Bitcoin ETFs Rebound as Ethereum and XRP ETFs Lose Momentum.
Liquid’s reported Bitcoin withdrawal
~4,000 BTC
Liquid Network reported approximately 4,000 BTC withdrawn from its federation wallet on September 6, 2026. This is the initial reported withdrawal, not the amount still outstanding after subsequent returns.Liquid put the approximate value of that withdrawal at about $320 million, a figure it described as the incident's estimated size rather than a verified transfer-time price for any single output. For related coverage, see Bitcoin Hits $82,000 as Fed Dovish Signals Lift Ethereum, XRP, Dogecoin.
Liquid’s approximate incident valuation
~$320 million
Liquid Network’s approximate valuation of the reported withdrawal on September 6, 2026. This is not an independently verified transfer-time USD value for transaction output 0 or a measure of final loss.The company said bridge nodes had been temporarily disabled and that no new transactions could be submitted, effectively pausing the sidechain at the time of the announcement. It added that the withdrawal used SideSwap's Peg-out Authorization Key while asserting that this key and the network's other keys had not been compromised.
Liquid also said exchanges had been notified and had paused or would pause L-BTC deposits and withdrawals, and that USDT, DePix and other real-world assets issued on Liquid were unaffected by the incident. That statement does not establish whether those assets remained transferable while the network was paused.
Because the announcement came directly from the affected operator, it should be read as the protocol's own account rather than a completed independent postmortem. The full statement is embedded below.
We are aware of a security incident on @Liquid_BTC. Purported white-hat hackers have withdrawn ~4,000 BTC (~$320 million) from the Liquid Federation wallet. The @Blockstream team is working on contacting them on-chain with a signed message.What we know so far is that the funds…
— Liquid Network 🌊 (@Liquid_BTC) September 6, 2026
Source: @Liquid_BTC on X
Explorer records give a more exact figure than the operator's round number. The withdrawal transaction, confirmed at block 965783 on September 6, 2026 at 14:28:56 UTC, sent exactly 3,996.01834922 BTC to a single output address, with all 83 inputs drawn from one federation-linked address.
ON-CHAIN DATA
The "white-hat" description originates with the actors, not with an independent finding. A related transaction confirmed September 6 at 18:30:10 UTC carried a decoded OP_RETURN message reading "we are whitehats. contact us on chain," which proves a self-description rather than benevolent intent, authorization or legal identity.
That distinction matters because the label alone does not establish permission to move the funds, an agreed bounty, or any commitment to return them. On the record so far, the event sits somewhere between a claimed authorized exercise and an outright theft, and the supplied evidence does not settle which.
Ledger Chief Technology Officer Charles Guillemet questioned the white-hat framing, as reported by NFT Plazas, noting that taking hundreds of millions of dollars before disclosure departs from conventional white-hat practice. According to unconfirmed reports in that same summary, an Elements software vulnerability allowed unauthorized L-BTC to be created and an existing fix had only been partially deployed; no technical postmortem or patch detail has been independently verified.
The clearest development is on-chain. A transaction confirmed at block 965950 on September 7, 2026 at 16:09:25 UTC returned exactly 3,400 BTC to the same federation-linked address, blockchain records show. That is a returned transfer, not proof of full recovery or that the sidechain has reopened.
Several widely circulated figures remain unverified. According to unconfirmed reports, the pre-incident reserve was roughly 4,200 BTC with about 95% withdrawn, but the historical wallet balance was not independently reconstructed, and the 4,200 BTC figure should not be treated as the amount taken.
What still needs corroboration is specific: the exact duration and paused functions, the transfer-time dollar basis for the withdrawal, the destination and eventual disposition of the funds, and whether user balances were affected. No regulator or law-enforcement filing has been verified, and "white-hat" carries no legal weight in this evidence set.
The market backdrop is calm rather than panicked. Bitcoin traded around $78,677 with a modest 24-hour move, a level that has drawn attention as traders weigh shifting Fed rate-hike odds and where Bitcoin sat after it reclaimed the $77,500 area. The broad crypto Fear & Greed Index sat at 69, in "Greed" territory, a market-wide reading that cannot be attributed to the Liquid incident and does not signal how Bitcoin's price could respond to any confirmed loss.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
Read original article on coinwy.comRead also :
