Bitcoin sidechain Liquid Network has been hit by one of the year's largest crypto security incidents. About 4,000 BTC left the network's federation wallet on Sunday, 6 September, prompting operators to pause the network. On Monday, 7 September, reports said around 3,400 BTC had been returned after bridge nodes were patched.
The incident is unusual because the initial public information did not point to a conventional theft of private keys. Liquid said the withdrawal used SideSwap's authorised Peg-out Authorization Key, while neither that key nor other federation keys had, according to the network, been compromised.
What happened to Liquid's bitcoin reserve?
On 6 September, Liquid said actors describing themselves as white hats had withdrawn about 4,000 of the roughly 4,200 BTC held in the Liquid Federation wallet. The value was then estimated at about $320 million.
The network halted new transactions and told exchanges that deposits and withdrawals of L-BTC, the bitcoin-representing asset used on Liquid, would be affected. The incident involved Liquid's federated sidechain and its bridge mechanism, not a breach of Bitcoin's base protocol.
Reuters reported on 7 September that Liquid had confirmed the withdrawal and pause. Later that day, The Block reported that about 3,400 BTC had been sent back to the federation address after Blockstream said affected bridge nodes had been patched. The same report said about 598.5 BTC remained with the actor.
A software bug rather than a stolen key
The most technically significant question is how the withdrawal became possible. According to updated reporting, SideSwap said L-BTC had been created through a bug in Elements, the software underpinning Liquid. Those assets could then be treated as valid in the peg-out process.
This puts the focus on bridge validation logic and on how a federated bitcoin reserve is protected against incorrectly created assets. That is a different risk profile from an attacker obtaining a private key or breaking into a centralised exchange.
For users, the distinction matters. Bitcoin's consensus and ordinary BTC transactions on the main chain were not affected by the reported bug. The problem was in the system that locks BTC on Bitcoin and represents it as L-BTC on Liquid.
Why the return does not close the incident
The reported return of most of the withdrawn assets reduces the immediate financial risk, but it does not mean the investigation is complete. The network needs to show that all relevant nodes are running corrected software and that the balance between circulating L-BTC and the bitcoin reserve can be restored and independently verified.
Questions also remain about the roughly 598.5 BTC that The Block said were still with the actor. The label 'white hat' should therefore be treated as the actor's own or the network's cautious description until identity, motive and final return of funds are established.
What the incident means for crypto markets
Liquid is used for faster settlement and for issuing digital assets backed by bitcoin. Its security model relies on a federation of participants rather than the same open proof-of-work model that secures Bitcoin's main chain. The incident is a real-world stress test of how federated bridges handle software defects.
The central lesson for the market is that 'bitcoin-based' infrastructure can carry risks that Bitcoin itself does not. A sidechain may use BTC as a reserve while adding layers of code, key management, peg-in and peg-out processes, and operator dependencies.
CoinMarketSite is watching three developments: when Liquid resumes normal network activity, whether the remaining bitcoin is returned, and whether a full technical post-mortem on the Elements bug is published. These will help determine the impact on Liquid users and confidence in similar federated bridges.
Sources and verification
Details were checked against Reuters' reporting on 7 September 2026 and The Block's rolling update from the same day. Amounts and status may change while the incident develops.
Crypto assets can fluctuate significantly in value. Check information across multiple sources and make decisions based on your own financial situation and risk tolerance.