What Happened
Liquid Network disclosed on Sunday that nearly its entire bitcoin reserve—approximately 4,000 of 4,200 BTC—was withdrawn from its Liquid Federation wallet in what the network described as a security incident, according to Bloomberg and Reuters. The network, launched in 2018 by Blockstream, immediately halted new transactions and warned users that wallet functionality would be disrupted while federation members work to restore service.
The perpetrators are described by Liquid as "purported white-hat hackers," individuals who exploit vulnerabilities with the stated intention of returning stolen funds, often in exchange for a bounty. According to The Block, Blockstream is attempting to contact the parties responsible through an onchain signed message, though neither the identity of the hackers nor confirmation of any return agreement has been disclosed. The network is overseen by a federation of more than 80 exchanges, infrastructure firms, and asset managers, according to CoinDesk.
According to CoinDesk, the exploit did not result from a compromised password or private key—the method behind most crypto hacks this year—but instead involved a different attack vector. The network issues L-BTC tokens against bitcoin locked in reserve to enable faster settlement than the main Bitcoin blockchain allows, and the near-total depletion of that reserve raises fundamental questions about the security architecture of the sidechain model.
Why It Matters
Liquid Network was built to solve a practical problem: the Bitcoin blockchain's slow transaction speed makes it inefficient for high-frequency exchange settlement. By issuing L-BTC tokens backed by bitcoin held in a federated reserve, the network enables exchanges to settle trades faster without waiting for Bitcoin's ten-minute block confirmation times. The withdrawal of nearly the entire reserve undermines confidence in this model and exposes the risks inherent in custodial sidechain architectures.
The incident adds to a series of security breaches that have plagued the crypto market throughout 2026, according to Bloomberg. While the white-hat designation suggests the possibility of fund recovery, the lack of confirmed communication or return terms leaves exchanges and users in limbo. The episode underscores the persistent security challenges facing crypto infrastructure, particularly in federated custody models where trust is distributed across multiple institutional participants rather than secured by cryptographic guarantees alone.
Sources & Context
This report is based on statements from Liquid Network posted on X, as well as coverage from Bloomberg, Reuters, CoinDesk, and The Block. All sources cite the same $320 million figure and the 4,000 BTC withdrawal amount. The classification of the perpetrators as white-hat hackers originates from Liquid's own public statement and has not been independently verified. No official confirmation of fund return negotiations or timelines has been provided by Blockstream or the federation members as of publication.
What to Watch Next
Monitor for official statements from Blockstream or federation members regarding contact with the alleged white-hat hackers and any timeline for fund recovery. Exchange disclosures about exposure to Liquid Network reserves will clarify institutional impact.
Mo Rawaha is an AI editorial persona used by Knightron Journal to represent content produced through Knightron's AI-assisted editorial workflow. Mo Rawaha is not a real journalist, employee or founder; the name is an editorial identity, not proof of authorship by a real individual.
