Liquid Network has paused bridge activity after nearly 4,000 bitcoin, worth about $320 million at the time, left the federation wallet that backs L-BTC. Liquid said the withdrawal was carried out by “purported white-hat hackers,” but that label remains unverified. The network disabled bridge nodes and told exchanges to halt L-BTC deposits and withdrawals while the incident is investigated (Reuters).
This is not a Bitcoin base-layer failure. It is a reminder that a token can inherit risk from the bridge, federation, software, and operational process that connects it to Bitcoin. For operators holding treasury assets or building around crypto settlement, the immediate lesson is to separate Bitcoin exposure from exposure to a particular wrapped or sidechain representation.
What happened
Reuters reported that around 4,000 of the roughly 4,200 BTC in Liquid’s federation wallet were withdrawn. Liquid said the funds moved through SideSwap’s peg-out process, while SideSwap said its authorization key was not compromised. Follow-up reporting attributed the creation of the L-BTC used in the withdrawal to a bug in Elements, the open-source software underpinning Liquid (Reuters; Cointelegraph).
The withdrawal represented about 95% of the reported reserve. Liquid said bridge nodes were temporarily disabled, stopping new transactions, and exchanges were asked to pause L-BTC deposits and withdrawals. Other assets issued on the network, including USDT, DePix, and real-world assets, were reported as unaffected in the initial updates (Cointelegraph).
The parties behind the transfer left an on-chain message saying they were white hats. Blockstream began contacting them through signed on-chain messages, and later messages reportedly demanded that the vulnerability be fixed and every node patched before most of the funds would be returned. No confirmed repayment or public patch had been announced in the latest available reporting (Crypto.news).
Why it matters
L-BTC is designed to represent bitcoin on Liquid, so users rely on the federation’s reserve and redemption machinery. When the reserve falls from about 4,200 BTC to a small remainder, the one-to-one assumption is no longer something users can take for granted while the incident remains unresolved. The technical details matter, but the operator-facing question is simpler: can the asset be redeemed, transferred, and reconciled under the conditions your business requires?
The incident also shows why a valid-looking authorization path is not the same as a safe authorization path. SideSwap reportedly processed the request as a normal customer order because the L-BTC presented to it appeared valid. If the software allowed unbacked L-BTC to reach a peg-out service, controls at the final signing step were not enough to protect the reserve.
For crypto businesses, that creates three separate exposures: smart-contract or protocol bugs, the concentration of assets in a federation wallet, and the liquidity risk that appears when exchanges suspend deposits and withdrawals. Bitcoin itself may keep trading normally while a related asset becomes operationally unusable.
What operators should do
- Pause new L-BTC inflows and redemptions in your own systems. Do not assume an exchange suspension will cover every wallet, OTC desk, or internal settlement path. Mark the asset as restricted and document the timestamp.
- Reconcile balances by asset and venue. Separate native BTC, L-BTC, and any other Liquid-issued assets. Record where each balance is held, which counterparty controls it, and whether a live withdrawal test is possible.
- Review bridge dependencies. For every wrapped asset you accept, document the reserve model, signer set, software version, emergency pause process, and the source of redemption liquidity. If the provider cannot answer those questions, size the exposure accordingly.
- Do not treat the “white hat” claim as recovery. A promise to return funds is not the same as a confirmed on-chain transaction. Keep customer and treasury reporting conservative until the reserve is restored and the patch is independently reviewed.
- Use a regulated primary venue for liquid BTC operations. Coinbase Advanced is one option to evaluate for spot BTC custody and trading workflows; compare its custody, withdrawal, and reporting fit with your own requirements before moving funds.
Recommended exchange
Coinbase Advanced
Up to 3.85% USDC rewards on trading balance, low maker/taker fees, and full Coinbase Advanced toolset.
This incident is still developing. The right response is not to make a broad call on every sidechain. It is to identify which part of your balance sheet depends on a bridge or federation and make sure a single software failure cannot stop customer operations.
Related links
- Learn: /learn/bitcoin-prediction-models-explained
- Learn: /learn/bitcoin-prediction-api-comparison-2026
- Tool: /tools/ai-model-comparison
Primary source: Reuters’ report on the Liquid Network withdrawal.
