On 6 September, roughly 4,000 of the 4,200 BTC held in the federation wallet backing Liquid Network — a Bitcoin sidechain built by Blockstream and used by exchanges to settle transactions faster and more privately than on Bitcoin itself — left in a single withdrawal worth about $320 million. That's around 95% of everything the wallet held, gone in one move.
What makes this stand out from an ordinary crypto theft is what happened next. Whoever moved the funds attached a message directly to a Bitcoin transaction, identifying themselves as a "whitehat" and inviting Blockstream to get in touch. Blockstream responded on-chain with contact details for its security team, and the conversation reportedly moved to encrypted channels from there. The message left on-chain was blunt about the terms: fix the bug first, confirm every node is patched, and only then will the money go back.
Some of it already has. Roughly 3,400 BTC — about $268 million — has since been returned, with the remaining 598 BTC, worth roughly $47 million, kept for now, in what looks like a self-assigned finder's fee rather than a full return.
How the withdrawal actually happened is the more interesting technical thread. Liquid confirmed the BTC moved out through SideSwap using something called a Peg-out Authorization Key, or PAK — a mechanism that lets federation members recognize which destinations are allowed to receive withdrawn Bitcoin. Critically, Liquid says neither SideSwap's key nor any other PAK appears to have been compromised, which leaves the harder question still open: how an apparently authorized withdrawal managed to empty almost the entire reserve without any key actually being stolen. Bitcoin's own network was untouched — the flaw sits in Liquid's federation software, specifically in the Elements codebase that governs peg-outs, not in Bitcoin's proof-of-work consensus.
Liquid has disabled its bridge nodes and asked exchanges to pause L-BTC deposits and withdrawals while the fix goes in. In the meantime, the reserve that's supposed to back every L-BTC in circulation sits at roughly 200 BTC, down from 4,200 — for all practical purposes, unbacked until the missing funds return, if they do.
Set against 2026 as a whole, the amount is large but not record-setting — industry trackers put total crypto losses across the first half of the year above $1.3 billion — but the pattern behind it is worth noting: a growing share of this year's biggest losses have come from cross-chain bridges and federated sidechains, infrastructure built on top of otherwise solid base chains, rather than from simple wallet or exchange breaches. Bitcoin's price barely reacted, dipping about 1% — a sign the market is treating this as a Liquid-specific failure, not a Bitcoin one. Whether that distinction holds up for Liquid's own reputation is a separate question, and one that won't be settled until it's clear whether the rest of the Bitcoin actually comes home.
Source: The Register