Bitcoin sidechain Liquid pauses after purported ‘white hats’ withdraw $320M in BTC

The Liquid sidechain came to an abrupt halt after unknown parties successfully extracted nearly the entirety of its backing Bitcoin reserve through an exploit in Elements software. The withdrawal froze bridge functionality across the network, forcing major exchanges to restrict L-BTC trading activity. Other assets issued on Liquid's infrastructure, including USDT and tokenized real-world assets, continued operating normally as the withdrawal specifically targeted the network's Bitcoin reserves.

The actors behind the extraction initiated contact with Blockstream through signed messages embedded in Bitcoin transactions, establishing themselves as white-hat security researchers rather than malicious thieves. This characterization carries significant weight in cryptocurrency communities, where white-hat designations typically indicate actors who discover vulnerabilities to alert developers rather than exploit them for personal gain. The correspondence, compiled and shared publicly by Jan3 CEO Samson Mow, documented a roughly four-hour negotiation window during Pacific business hours.

Blockstream engaged with the actors through encrypted communications, eventually acknowledging their offer to return the funds contingent on resolving the vulnerability and achieving comprehensive node updates. The security firm's brief affirmative response became the subject of interpretation disputes, with Mow noting potential ambiguity about whether Blockstream was simply confirming the return address or formally accepting the patching condition. At the reporting cutoff, the 4,000 BTC remained in the actors' control.

Investigation into the extraction method revealed the exploit operated through SideSwap's peg-out service, using that platform's authorization infrastructure. SideSwap clarified that its Peg-out Authorization Key had not been compromised, attributing the successful withdrawal to the upstream Elements bug that the actors leveraged. This distinction clarified that the vulnerability existed at Liquid's core software layer rather than through any third-party integration failure.

The incident exposes structural tensions in sidechain security models that depend on federation participants controlling consolidated Bitcoin reserves. Unlike traditional financial systems with redundant safeguards, the federation wallet's near-total depletion demonstrates how a single software vulnerability can render a multi-billion-dollar bridge mechanism inoperable, pending coordinated patching efforts across a distributed node network.