Blockstream's Liquid Pauses as $320M in Bitcoin Leaves the Federation

Roughly 4,000 bitcoin left the wallet that backs Blockstream's Liquid sidechain on Sunday afternoon, and the network has been paused since. The party that moved the coins attached an on-chain message calling themselves white hats and asking to be contacted the same way. Blockstream answered on-chain with an email address. Liquid's own statement put the amount near $320 million, about 95% of the roughly 4,200 bitcoin the federation held. Blocks are still being produced, but bridge nodes are off and exchanges have stopped L-BTC deposits and withdrawals.

Six counts of one withdrawal

Nobody publishes the same number. Liquid said about 4,000 BTC. The Defiant logged 3,998.49748445 BTC, worth roughly $319.5 million at a bitcoin price of $79,901, while TFTC gave about 3,998.5 BTC and $319 million. Bitcoin.com News reported 3,996 BTC as the figure confirmed by SideSwap, the venue the peg-out ran through. Bitcoin Magazine counted 4,019.4 BTC and coin-turk 4,019. Not one of those accounts says which blocks or which addresses it measured, and they do not reconcile. What is left behind is disputed on the same pattern: 197.47 BTC on The Defiant's reading, 207.275 at TFTC, about 207 at Bitcoin Magazine. Every outlet agrees the dollar value is near $320 million.

A bug in Elements, not a stolen key

The withdrawal used SideSwap's Peg-out Authorization Key, and Liquid said that key was not compromised.

"Purposed white-hat hackers have withdrawn ~4,000 BTC (~$320 million) from the Liquid Federation wallet. The funds were withdrawn via the SideSwap PAK (Peg-out Authorization Key), but that key was not compromised," Liquid said. The misspelling is in the original.

SideSwap told Cointelegraph the L-BTC in the transaction came out of a bug in Elements, the open-source software Liquid runs on. CoinDesk, writing at 03:43 UTC on Monday, carried Blockstream's version of the same finding: a software bug in Elements rather than compromised keys, with SideSwap unable to tell coins the bug had created from genuine ones. Bitcoin Magazine calls it an inflation bug that let more than 4,000 L-BTC exist at all. Samson Mow said the working theory pointed at Liquid's confidential transactions, the feature that hides amounts on the sidechain, and called it a node-level issue with nothing to do with authorization keys or hardware modules. That reading stands in one account, and developers had not confirmed it.

What the timestamps say

The clock is not settled either. The Defiant logs a first withdrawal at 14:01 UTC in block 965780 and a second one 27 minutes later, with the on-chain message arriving about four hours after that. Bitcoin.com News has SideSwap processing the order at 14:05 UTC and the federation paying out at 14:28. Four minutes apart at the start, and neither account cites the other. Blockstream's public reply went up at 16:25 Eastern. A normal peg-out has to clear three checks: L-BTC burned on Liquid, a signature from 11 of the federation's 15 members, and a match against the whitelist of authorized keys. On everything published so far, all three cleared. Chains have gone dark and come back this year; Cronos restarted with the Tectonic exploit rolled back in late August.

Nothing has come back yet

The coins have not moved from the receiving address. Cointelegraph reported that the party asked Blockstream to patch the bug and see every node updated before returning most of the bitcoin, and sent encrypted technical details; no other outlet carries that. Ledger's chief technology officer, Charles Guillemet, questioned the white-hat label, noting that a request to move the conversation to Signal is not how security researchers usually work and not how thieves usually work either. That observation also sits in a single account. USDT, DePix and the real-world assets issued on Liquid are untouched, and no restart date has been given. The incident puts the trust model in plain view: L-BTC is a claim on a consortium's reserves, not on bitcoin. CertiK has spent the year putting operational failures at about three-quarters of 2026's losses, well ahead of faulty code. Liquid, on the current evidence, lands on the other side of that split.