$32 Million BTC Transferred from Liquid Sidechain Wallets
The Liquid Bitcoin sidechain experienced a significant transfer of roughly 4,000 BTC—valued at around $32 million—from its federation wallets. This amount amounts to 95% of the total BTC supply on the Liquid network. The moved funds were sent to a single Bitcoin address containing a message on-chain stating, "we are whitehats. contact us on chain."
In response, the Liquid team has halted operations of its bridge nodes and instructed partner exchanges to suspend deposits and withdrawals of Liquid Bitcoin (L-BTC) to prevent further disruption. Other assets operating on the Liquid network, such as USDT, DePix, and certain physical asset tokens, have not been affected. Federation members are actively working on measures to restore normal network functionality as swiftly as possible.
Ledger CTO Casts Doubt On White Hat Characterization
Charles Guillemet, Chief Technology Officer at Ledger, a leading hardware wallet provider, expressed skepticism regarding the attackers' self-identification as white hat hackers. Guillemet highlighted that legitimate white hats typically do not transfer large sums of funds post-intrusion or seek contact through on-chain messages. He compared the event to the 2022 Ronin bridge hack, where hackers stole approximately $625 million by compromising validator keys.
He remarked that the behavior observed is inconsistent with white hat protocols and leans more toward malicious intent. Nonetheless, Guillemet emphasized that definitive conclusions should await further investigation, specifically whether a vulnerability in Liquid’s software was exploited.
Potential Sidechain Software Vulnerability Behind the Transfer
Blockstream has tracked the movement of these L-BTC coins and identified that the withdrawals were authorized via SideSwap’s peg-out multisignature keys. Liquid maintains these keys were not compromised. SideSwap clarified that at 14:05 UTC, a withdrawal request for 4,000 L-BTC was submitted to their on-chain withdrawal service; 23 minutes later, the federation approved a payment of 3,996 BTC.
Suspicions point toward a flaw within Liquid’s underlying Elements software, possibly enabling unauthorized control of peg-out permissions. Liquid’s federation and developers are scrutinizing the situation closely to confirm the root cause.
Exchange Responses and Market Implications
Following the incident, several digital asset exchanges have temporarily suspended Liquid Bitcoin-related deposit and withdrawal services as a precaution. As a bridge linking Bitcoin’s mainnet and the Liquid sidechain, the network’s security is critical for traders and investors relying on its faster transaction capabilities.
The large scale of the transferred funds—nearly the entirety of Liquid’s BTC sidechain supply—raises concerns over confidence in the network’s ecosystem. Market participants remain attentive to ongoing updates regarding incident investigation and service restoration.
This event underscores the heightened risks associated with blockchain bridging technologies in the crypto sector and calls for careful scrutiny of purported white hat interventions in security breaches. The outcome of Liquid’s response and any regulatory developments will be key to assessing the broader impact on sidechain bridging solutions.