Liquid Network Halts After $320M Bitcoin Hack

The Bitcoin-based Liquid Network paused operations and halted new transactions after approximately $320 million in bitcoin was drained from its federation reserves by actors claiming to be white-hat hackers. The incident drained roughly 4,000 of the 4,200 total bitcoin held in the federation wallet, marking one of the largest infrastructure-level drainage events for a Bitcoin-adjacent sidechain network.

"Liquid wallets will be impacted, and we're sorry for any inconvenience," the network stated in a post on X, announcing an immediate halt to all new network transactions.

How the SideSwap Withdrawal Occurred

According to reports detailing the network statement, the funds were removed through SideSwap, a specialized settlement platform authorized to handle withdrawals from the protocol. Liquid Network operators emphasized that the underlying master key utilized in the withdrawal process was not directly compromised during the breach, pointing instead to operational vectors within the integration.

The Liquid Network functions as a federated sidechain designed to enable faster, more confidential Bitcoin transactions and the issuance of digital assets. Because federation models rely on a select group of functionaries to secure and manage the reserve assets backing the sidechain, unauthorized access to withdrawal pathways exposes structural vulnerabilities distinct from base-layer Bitcoin mainnet security.

Disputed White-Hat Claims and Industry Response

The exploit quickly drew skepticism from security experts across the digital asset sector regarding the attackers' self-described white-hat status. Charles Guillemet, chief technology officer at Ledger, challenged the framing in comments cited by BigGo Finance, arguing that genuine white-hat operators do not typically siphon a bridge of nearly all its reserves while simultaneously soliciting contact via on-chain messages.

The $320 million loss places the Liquid Network breach among notable historical infrastructure exploits, comparable in scale to major decentralized finance and cross-chain bridge incidents such as the Ronin Network and DMM Bitcoin hacks. As investigators and federation members trace the movement of the 4,000 drained bitcoin, the network remains offline, leaving users unable to execute settlements or transfer assets across the sidechain ecosystem.