About 4,000 BTC withdrawn from Liquid

Blockstream’s status page said on September 7 that purported white-hat hackers withdrew about 4,000 bitcoin, worth roughly $320 million, from the federation wallet backing the Liquid Network. The company said the funds moved through the SideSwap Peg-out Authorization Key, or PAK, path, while adding that the key itself “was not compromised, nor were any others.” Bridge nodes were disabled, new transactions were halted and exchanges were told to pause LBTC deposits and withdrawals while federation members investigated the incident. ### How did Liquid describe the incident? Liquid’s official incident notice said the affected component was its public bridge nodes and that the sidechain was “effectively” paused until the issue was resolved. Blockstream said wallets on the network would be impacted, but that other Liquid-issued assets including USDT, DePix and real-world assets were unaffected. (status.blockstream.com) Cointelegraph, citing public on-chain correspondence, reported that the actors identified themselves as white hats and told Blockstream they would return most of the bitcoin after the vulnerability was fixed and nodes had installed a patch. Blockstream said on its status page that it was trying to contact the actors with a signed on-chain message. (status.blockstream.com) ### What exactly is LBTC, and why does that matter here? Blockstream’s help documentation says LBTC is Liquid Bitcoin, an asset on the Liquid sidechain that is designed to be backed 1-for-1 by bitcoin held by the Liquid Federation on the Bitcoin mainchain. The same documentation says anyone can verify that the amount of LBTC on Liquid matches the amount of BTC held in the federation multisig wallet. (status.blockstream.com) That structure matters because a peg-out burns LBTC on Liquid and releases the corresponding BTC on Bitcoin’s main chain. Blockstream says only Liquid Federation members can complete peg-outs, and the mainchain bitcoin is secured in an 11-of-15 multisig arrangement using functionary devices operated by federation members. ### Where does SideSwap fit into the process? (help.blockstream.com) SideSwap says on its own documentation that it is a Liquid Federation member and can perform peg-outs on behalf of users. Its FAQ says a peg-out converts LBTC back into BTC on the Bitcoin mainchain after two confirmations on Liquid, with the BTC then sent from the federation multisig wallet to a whitelisted address held by the federation member performing the peg-out. (help.blockstream.com) SideSwap also says its peg-in service credits users from a hot wallet and batches deposits into larger federation peg-ins behind the scenes. Blockstream’s incident notice said the withdrawn funds moved through the SideSwap PAK route, and Cointelegraph reported that SideSwap said the withdrawal passed through its peg-out service as a customer order while maintaining that the PAK was not compromised. ### Was Bitcoin itself affected? (sideswap.io) Blockstream’s incident notice was limited to Liquid, not Bitcoin itself. Liquid’s documentation describes the network as a separate sidechain attached to Bitcoin through a two-way peg, with its own bridge nodes and federation-run infrastructure. That means the disruption was to the sidechain’s peg and transaction flow, not to Bitcoin’s base-layer consensus. (sideswap.io) Cointelegraph separately reported that the withdrawal represented roughly 95% of the wallet’s approximately 4,200 BTC balance, though that figure did not appear in Blockstream’s own incident notice. ### What should users watch now? September 7 is the latest official update visible on Blockstream’s status page, and it says federation members are working to restore normal network activity. (status.blockstream.com) Until that changes, bridge nodes remain disabled, no new Liquid transactions can be submitted, and LBTC deposits and withdrawals at exchanges may remain paused. (cointelegraph.com) Blockstream’s next concrete milestone is a public status update showing the incident resolved or bridge nodes restored. Users with exposure to LBTC, peg-outs or exchange transfers will likely need to watch the Liquid status page and notices from named platforms handling Liquid balances for the next operational update. (status.blockstream.com)