CoinDesk
Liquid Network, the Bitcoin sidechain exchanges use for fast settlement, halted all transactions after roughly $320 million in bitcoin, about 4,000 of 4,200 BTC held in its federation wallet, were withdrawn in an exploit the attackers are framing as a white-hat operation. Blockstream, which launched Liquid in 2018, attributed the drain to a software bug in its Elements codebase rather than compromised private keys, and the funds are moving through SideSwap, an approved trading platform on the network.
Why it matters
The episode cuts at the structural promise of the Liquid model. Liquid issues L-BTC against bitcoin locked in reserve so exchanges can settle trades in minutes rather than waiting for slow Bitcoin block confirmations, and a near-total drain of that reserve is the worst-case scenario for the design. Federation members, more than 80 exchanges, infrastructure firms and asset managers, will have to answer whether the L-BTC their users hold remains fully backed while roughly 95% of the reserve sits in motion through an attacker-controlled path.
The exploit also differs from most major crypto drains this year. The stolen funds did not move through mixers or cross-chain bridges; they left through SideSwap, a normal and approved trading venue, because the bug produced valid-looking bitcoin inside the Elements system. SideSwap said it could not distinguish which coins came from the bug and which were real, so it treated them identically.
Market impact
The drain lands on top of two recent security hits in Bitcoin-adjacent infrastructure: a $6 million exploit on a lending platform linked to Crypto.com last week, and an August breach involving the Coldcard hardware wallet. Liquid has not said when the network will reopen or whether the bitcoin will be returned, and the federation's ability to recover depends on whether the self-styled white-hats honour the implicit deal that typically follows this kind of disclosure.
Watch the next 48 hours for federation member statements on L-BTC solvency coverage, and on whether Liquid's other assets, including stablecoins and other tokens on the same network, remain unaffected as Blockstream has claimed.
Frequently asked questions
-
What is Liquid Network and why do exchanges use it?
Liquid is a Bitcoin sidechain launched in 2018 by Blockstream that issues L-BTC against bitcoin locked in reserve, letting exchanges settle trades in minutes rather than waiting for slow Bitcoin block confirmations.
-
How were attackers able to drain $320M without compromised private keys?
Blockstream attributed the exploit to a software bug in its Elements codebase that produced valid-looking bitcoin inside the system, letting the attackers withdraw funds through SideSwap, which could not tell bug-created coins apart from real ones.
-
Will Liquid Network users get their bitcoin back?
Liquid has not confirmed whether the bitcoin will be returned. The attackers have framed the exploit as a white-hat operation, and the federation is now working to restore normal network activity.
-
How many exchanges and institutions sit inside the Liquid federation?
The federation includes more than 80 exchanges, infrastructure firms and asset managers, all of which rely on the L-BTC reserve to settle transactions quickly.
-
Is this hack connected to other recent Bitcoin security incidents?
It follows a $6 million exploit on a lending platform linked to Crypto.com last week and an August breach involving the Coldcard hardware wallet, part of a cluster of security issues across Bitcoin-adjacent infrastructure.
CoinTelegraph
Lookonchain
WuBlockchain
TheBlock
CryptoSlate