Hackers Drain $320 Million in Bitcoin From Liquid Network Wallet

The Liquid Network, a Bitcoin-based settlement and payments sidechain used by cryptocurrency exchanges and financial institutions, has suspended operations after hackers withdrew approximately 4,000 Bitcoin, valued at around $320 million, from its federation wallet.

The incident was disclosed by the network on Sunday, with Liquid confirming that roughly 95% of the Bitcoin held in its reserve wallet had been transferred out during what it described as a security breach. As an immediate precaution, the network disabled its bridge infrastructure, halted new transactions and warned users that Liquid wallets and L-BTC services would be temporarily affected.

Attackers call themselves “white-hat” hackers

Adding an unusual twist to the breach, the individuals behind the withdrawal have publicly claimed to be white-hat hackers—a term typically used for security researchers who expose vulnerabilities rather than steal assets for profit.

According to messages embedded directly into Bitcoin transactions, the attackers contacted Blockstream, the company behind Liquid’s underlying technology, and said they intended to return most of the funds once the software flaw responsible for the exploit had been fully patched across the network. As of publication, however, the Bitcoin remained under the attackers’ control and had not been returned.

What actually happened?

Importantly, the breach did not compromise Bitcoin’s core blockchain. Instead, investigators say the exploit targeted Liquid’s sidechain infrastructure, specifically a vulnerability within Elements, the open-source software powering the network.

Liquid and SideSwap, a platform authorized to process peg-out transactions, both said the cryptographic authorization key used during the withdrawals was not stolen or compromised. Their preliminary assessment points to a software bug that allowed fraudulent L-BTC to be redeemed for real Bitcoin held in the federation reserve wallet.

Exchanges suspend services

The security incident has prompted exchanges supporting Liquid-based assets to suspend L-BTC deposits and withdrawals while developers investigate the flaw. Liquid said other tokenized assets issued on the network, including certain stablecoins and real-world assets, were not directly affected by the exploit, although bridge operations remain paused until the system is deemed safe.

Cybersecurity analysts say the episode highlights the growing distinction between attacks on Bitcoin itself and attacks on infrastructure built around it. While Bitcoin’s base protocol continues to operate normally, sidechains, bridges and settlement layers have increasingly become attractive targets because they manage large pools of digital assets through more complex software.

The breach is likely to intensify scrutiny of the security architecture underpinning institutional crypto networks. As digital asset platforms expand beyond trading into global payments and settlement, the resilience of the software surrounding blockchain ecosystems, not just the blockchains themselves, is becoming one of the industry’s biggest trust tests.