On Sep 6, 2026, Liquid Network said purported white-hat hackers withdrew about 4,000 BTC, worth about $320 million, from the federation wallet that backs L-BTC. Bitcoin Magazine reported a peg-out of 4,019.4 BTC through the SideSwap Peg-out Authorization Key to an address ending 6gyqjlte, with an OP_RETURN message reading "we are whitehats. contact us on chain." Cointelegraph's Hodler's Digest said Liquid explorer data showed the federation wallet balance fell from about 4,200 BTC to 207.275 BTC, and described the take as a shade under 4,000 BTC / about $319 million.
The official Liquid account said bridge nodes were disabled and the sidechain was paused, while exchanges were told to pause LBTC deposits and withdrawals. Other issued assets on Liquid, including USDT, DePix and RWAs, were described as unaffected. Liquid said the funds were withdrawn via the SideSwap PAK but that key was not compromised. SideSwap said Blockstream established that the L-BTC in that order was created through a bug in Elements software. Full technical confirmation of an inflation-bug path remains incomplete in public reporting.
Under normal Liquid mechanics, LBTC is burned on the sidechain before bitcoin is withdrawn, with an 11-of-15 federation multisig authorizing movement from reserves. JAN3 CEO Samson Mow said Aqua's Liquid features were affected while on-chain bitcoin still worked, and that teams were actively working to resolve the incident. At the time of the reports cited here, the withdrawn coins were described as still sitting at the destination address.
Liquid Network (@Liquid_BTC); Bitcoin Magazine; Cointelegraph Hodler's Digest; Crypto Briefing; SideSwap