A major security incident has disrupted the Bitcoin-linked Liquid Network after roughly 4,000 Bitcoin worth about $320 million were withdrawn from its federation wallet

.

Liquid Network said the funds were taken by individuals it described as “purported white-hat hackers”—a term used for people who claim to exploit vulnerabilities to protect funds rather than permanently steal them. The network has halted new transactions while its operators investigate what happened.

Nearly 4,000 Bitcoin Withdrawn

Liquid reported that approximately 4,000 of the roughly 4,200 Bitcoin held in its federation wallet were removed, representing about 95% of the Bitcoin reserve associated with the wallet.

The withdrawal was carried out through SideSwap, a settlement platform authorized to process certain withdrawals from Liquid. Importantly, Liquid said the authorization key used in the transaction was not compromised, leaving questions about how the withdrawal was successfully executed.

Network Transactions Suspended

Following the incident, Liquid temporarily stopped new transactions and disabled parts of its bridge infrastructure.

The network also warned that Liquid wallets could be affected by the disruption. Exchanges were notified, with some suspending deposits and withdrawals involving Liquid Bitcoin, or LBTC, while the investigation continues.

Liquid’s technology provider, Blockstream, is attempting to communicate with the parties responsible through on-chain messages as the network works to determine how the incident occurred.

Hackers Claim to Be White Hats

The people behind the withdrawal have reportedly identified themselves as white-hat hackers.

That claim has not been independently verified. Liquid itself has used cautious language by referring to them as “purported” white hats rather than confirming that the funds were taken as part of an authorized security operation.

White-hat hackers sometimes exploit vulnerabilities to prevent malicious attackers from taking funds and may subsequently return the assets after negotiating a security reward. However, until the money is recovered and the circumstances are established, the incident remains a serious security breach.

Bitcoin Itself Was Not Hacked

The incident does not represent a compromise of Bitcoin’s underlying blockchain.

Liquid is a separate Bitcoin sidechain designed to provide faster and more confidential transactions and to support digital assets. Bitcoin’s main network continues to operate independently of the Liquid security incident.

The vulnerability therefore concerns Liquid’s own infrastructure and withdrawal mechanisms rather than Bitcoin’s core protocol.

Questions Over How the Withdrawal Happened

The incident is attracting particular attention because Liquid said that the relevant cryptographic key was not compromised.

That raises questions about whether the problem involved software logic, the withdrawal authorization process or another component of the system rather than a straightforward theft of private keys.

Independent blockchain researchers have also been examining the transaction and the movement of the funds to understand precisely how the withdrawal was authorized.

Growing Pressure on Crypto Security

The incident adds to broader concerns about security across the digital-asset industry.

Large cryptocurrency platforms, bridges and blockchain infrastructure remain attractive targets because a single vulnerability can potentially expose enormous amounts of digital assets.

For investors and exchanges, the Liquid incident is another reminder that security risks can exist not only at individual cryptocurrency wallets but also in the infrastructure connecting different blockchain systems.

Investigation Continues

Liquid and its federation members are working to determine what happened and how normal operations can be restored.

The immediate priority is understanding the mechanism behind the withdrawal and establishing whether the Bitcoin can be recovered. Until those questions are resolved, transactions on affected parts of the Liquid ecosystem are expected to remain restricted.

The $320 million incident could also prompt renewed scrutiny of security controls used by Bitcoin sidechains and other blockchain networks that rely on centralized or federated mechanisms to manage large cryptocurrency reserves.