Liquid’s halt turned on the a part of the community that issues most to L-BTC holders: the reserve mechanism behind its said 1:1 Bitcoin peg. Practically 4,000 BTC left the federation pockets by way of the peg-out path, whereas Liquid mentioned the federation’s keys had not been compromised.
Liquid Community provides quicker Bitcoin settlement and points tokenised belongings. Nonetheless, the incident that halted the sidechain occurred at a extra centralised a part of its design: the federation-operated mechanism connecting L-BTC with the Bitcoin held in reserve.
We’re conscious of a safety incident on @Liquid_BTC. Purported white-hat hackers have withdrawn ~4,000 BTC (~$320 million) from the Liquid Federation pockets. The @Blockstream crew is engaged on contacting them on-chain with a signed message.
What we all know to date is that the funds…
— Liquid Community 🌊 (@Liquid_BTC) September 6, 2026
How the Peg-Out Mechanism Grew to become the Failure Level
Below Liquid’s documented mannequin, every L-BTC is meant to be backed by an equal quantity of BTC held within the federation pockets. Shifting belongings in the wrong way requires destroying L-BTC earlier than the federation releases BTC by way of a peg-out.
That mechanism turned the crucial level of failure on Sunday when actors described as “purported white-hat hackers” withdrew roughly 4,000 BTC, price about $320 million, from the Liquid Federation pockets, in accordance with the community’s assertion.
The pockets held about 4,200 BTC earlier than the incident. The funds had been withdrawn by way of the Peg-out Authorisation Key operated by settlement platform SideSwap.
Liquid mentioned the important thing itself, and the community’s different keys, had not been compromised. A preliminary account as an alternative factors to a software program vulnerability affecting the L-BTC issuance and redemption course of.
Unbacked L-BTC was allegedly created after which offered for a peg-out, permitting the corresponding BTC to go away the federation reserve. Liquid had not launched an impartial technical autopsy confirming that sequence by September 7.
Federation members quickly turned off the bridge nodes, stopping new transactions from being submitted and successfully pausing the sidechain.
Exchanges had been notified and had suspended, or had been getting ready to droop, L-BTC deposits and withdrawals.
The Reserve Query Stays
Liquid mentioned different belongings issued on the community, together with USDT, DePix and real-world belongings, weren’t affected by the safety incident.
Nonetheless, turning off the bridge nodes additionally interrupted the community that transfers these belongings. The obvious mechanism is nearer to the 2022 Wormhole incident, which concerned unbacked wrapped belongings, than to the compromise of validator keys behind the Ronin Bridge assault.
It additionally resembles Nomad’s failure on the message-verification layer, though Nomad operated as a permissionless cross-chain bridge relatively than a federated Bitcoin sidechain.
The actors reportedly provided to return a lot of the BTC after the vulnerability was mounted, however no confirmed compensation had been reported by September 7.
Out there accounts counsel this can be the primary publicly recognized incident of this scale to empty virtually the complete Liquid Federation reserve by way of the L-BTC peg-out mechanism.
Nonetheless, a autopsy is required to verify that. The speedy monetary impact due to this fact extends past the federation pockets. With about 4,000 of 4,200 BTC eliminated, the reserve supporting Liquid’s said 1:1 L-BTC peg was left virtually completely depleted.
Replace: The actors later returned 3,400 BTC to the Liquid Federation deal with in Bitcoin block 965,950, after an on-chain alternate with Blockstream by way of OP_RETURN messages and PGP-signed textual content.
The switch represented about 85% of the withdrawn funds, whereas roughly 598.5 BTC, price about $47 million, remained within the actors’ pockets, in accordance with the reporting by The Block.
Liquid’s halt turned on the a part of the community that issues most to L-BTC holders: the reserve mechanism behind its said 1:1 Bitcoin peg. Practically 4,000 BTC left the federation pockets by way of the peg-out path, whereas Liquid mentioned the federation’s keys had not been compromised.
Liquid Community provides quicker Bitcoin settlement and points tokenised belongings. Nonetheless, the incident that halted the sidechain occurred at a extra centralised a part of its design: the federation-operated mechanism connecting L-BTC with the Bitcoin held in reserve.
We’re conscious of a safety incident on @Liquid_BTC. Purported white-hat hackers have withdrawn ~4,000 BTC (~$320 million) from the Liquid Federation pockets. The @Blockstream crew is engaged on contacting them on-chain with a signed message.
What we all know to date is that the funds…
— Liquid Community 🌊 (@Liquid_BTC) September 6, 2026
How the Peg-Out Mechanism Grew to become the Failure Level
Below Liquid’s documented mannequin, every L-BTC is meant to be backed by an equal quantity of BTC held within the federation pockets. Shifting belongings in the wrong way requires destroying L-BTC earlier than the federation releases BTC by way of a peg-out.
That mechanism turned the crucial level of failure on Sunday when actors described as “purported white-hat hackers” withdrew roughly 4,000 BTC, price about $320 million, from the Liquid Federation pockets, in accordance with the community’s assertion.
The pockets held about 4,200 BTC earlier than the incident. The funds had been withdrawn by way of the Peg-out Authorisation Key operated by settlement platform SideSwap.
Liquid mentioned the important thing itself, and the community’s different keys, had not been compromised. A preliminary account as an alternative factors to a software program vulnerability affecting the L-BTC issuance and redemption course of.
Unbacked L-BTC was allegedly created after which offered for a peg-out, permitting the corresponding BTC to go away the federation reserve. Liquid had not launched an impartial technical autopsy confirming that sequence by September 7.
Federation members quickly turned off the bridge nodes, stopping new transactions from being submitted and successfully pausing the sidechain.
Exchanges had been notified and had suspended, or had been getting ready to droop, L-BTC deposits and withdrawals.
The Reserve Query Stays
Liquid mentioned different belongings issued on the community, together with USDT, DePix and real-world belongings, weren’t affected by the safety incident.
Nonetheless, turning off the bridge nodes additionally interrupted the community that transfers these belongings. The obvious mechanism is nearer to the 2022 Wormhole incident, which concerned unbacked wrapped belongings, than to the compromise of validator keys behind the Ronin Bridge assault.
It additionally resembles Nomad’s failure on the message-verification layer, though Nomad operated as a permissionless cross-chain bridge relatively than a federated Bitcoin sidechain.
The actors reportedly provided to return a lot of the BTC after the vulnerability was mounted, however no confirmed compensation had been reported by September 7.
Out there accounts counsel this can be the primary publicly recognized incident of this scale to empty virtually the complete Liquid Federation reserve by way of the L-BTC peg-out mechanism.
Nonetheless, a autopsy is required to verify that. The speedy monetary impact due to this fact extends past the federation pockets. With about 4,000 of 4,200 BTC eliminated, the reserve supporting Liquid’s said 1:1 L-BTC peg was left virtually completely depleted.
Replace: The actors later returned 3,400 BTC to the Liquid Federation deal with in Bitcoin block 965,950, after an on-chain alternate with Blockstream by way of OP_RETURN messages and PGP-signed textual content.
The switch represented about 85% of the withdrawn funds, whereas roughly 598.5 BTC, price about $47 million, remained within the actors’ pockets, in accordance with the reporting by The Block.
