Liquid Sidechain Balance Falls From 4,200 BTC to 207 BTC After $320M Drain

Blockstream’s Liquid Network, a federated Bitcoin sidechain, saw its federation wallet balance fall from roughly 4,200 BTC to about 207 BTC on Sunday, September 6, 2026. Purported “white hat” hackers moved the funds off-chain, and three independently reporting outlets, Cointelegraph, Bitcoin Magazine and The Block, confirm the core event: bridge nodes were disabled and the sidechain was paused within hours.

All three sources agree on the dollar figure at time of withdrawal: roughly $319 million to $320 million. Liquid Network’s own account said the withdrawal used the SideSwap Peg-out Authorization Key, and stated plainly that “the funds were withdrawn via the SideSwap PAK (Peg-out Authorization Key), but that key was not compromised, nor were any others.” Other assets issued on Liquid, including USDT, DePix and tokenized real-world assets, were reported unaffected.

One Event, Two Withdrawal Counts

Here is where source-verification matters. Cointelegraph put the withdrawn amount at 3,998.5 BTC, calculated from the federation wallet dropping from 4,200 BTC to 207.275 BTC. Bitcoin Magazine reported 4,019.4 BTC moved out via the peg-out transaction, with the reserve settling at “a little over 207 BTC.”

Both figures round to roughly 4,000 BTC and land within about 21 BTC of each other, worth roughly $1.7 million at the time. That gap is small enough to reflect rounding or differing snapshot times rather than a factual contradiction, but it is not yet resolved by an on-chain reconciliation both outlets cite the same way. Readers building on Liquid data feeds should treat the exact figure as unsettled until Blockstream publishes a final reserve audit.

How the Funds Reportedly Left

Under normal Liquid mechanics, L-BTC must be burned on the sidechain before a peg-out releases Bitcoin from the federation treasury, and a valid transaction requires signatures from 11 of the 15 multisig members before funds go to a pre-approved whitelisted address.

Bitcoin Magazine reported, citing details that remain unconfirmed by other outlets, that an inflation bug in the L-BTC sidechain let the attackers mint more than 4,000 L-BTC that never existed, then redeem it for real Bitcoin. Because the fraudulent mint passed as valid under the flawed consensus rule, the federation’s own hardware security modules signed off on the withdrawal. This mechanism has not yet been independently corroborated by Cointelegraph or The Block and should be read as single-sourced pending Blockstream’s own post-mortem.

Liquid Network confirmed the practical fallout regardless of root cause: “Bridge nodes have been temporarily disabled, so no new transactions can be submitted to the network. Effectively, the Liquid sidechain is paused until this issue is resolved.”

White Hat or Not, the Coins Are Sitting Still

An unverified OP_RETURN message attached to the transaction read: “we are whitehats. contact us on chain.” Analyst DBCrypto pointed to on-chain behavior as circumstantial support: “the coins aren’t running and they’re just sitting on Bitcoin and haven’t been mixed. That’s more consistent with a whitehat extraction than a theft.”

DBCrypto also flagged the governance problem the incident exposes regardless of intent: “Either 11 of 15 functionaries signed this off, or the whitelist built to prevent exactly this didn’t hold. Neither answer makes Liquid look good.” Jan3 CEO Samson Mow addressed the situation on X: “Everyone is actively working to resolve this…These are difficult times but we’ll pull through.” The Block reported that exchanges have begun suspending L-BTC deposits and withdrawals while Blockstream attempts to identify and contact those responsible.

As of publication, Blockstream and Adam Back had not posted further public statements confirming a root cause or a timeline for restoring bridge nodes. The federation wallet’s on-chain balance, currently around 207 BTC, remains the clearest verifiable marker of the drain until Liquid Network publishes a formal reserve reconciliation.

Read more: Lazarus Group Wallets Moved $30M in Bitcoin Through Hyperliquid in Three Weeks

Sources

• cointelegraph.com
• bitcoinmagazine.com
• theblock.co