A major security incident involving the Bitcoin-based Liquid Network has become one of the biggest cryptocurrency stories of September 2026 after approximately 4,000 BTC, worth around $320 million at the time, was withdrawn from the network's federation wallet.
Liquid Network said the parties involved presented themselves as white-hat hackers, while the network temporarily halted new transactions as developers and federation members investigated the incident.
What Happened to Liquid Network?
Liquid Network reported the security incident on September 6, 2026 after an unusually large amount of bitcoin was withdrawn from its federation wallet.
According to the network, roughly 4,000 BTC were withdrawn from a wallet that contained approximately 4,200 BTC.
At the time of reporting, the withdrawn bitcoin was valued at approximately $320 million.
Because of the scale of the withdrawal, Liquid halted new network transactions while the incident was investigated.
Who Withdrew the Bitcoin?
Liquid Network referred to the parties responsible as “purported white-hat hackers.”
A white-hat hacker is generally a security researcher who identifies vulnerabilities with the intention of helping an organization repair them instead of permanently stealing assets.
However, the word purported is important. The description reflects what was claimed about the parties involved and should not be interpreted as final proof of their identity or intentions.
If the parties ultimately return the funds and provide technical details of a vulnerability, the incident could become a major security disclosure. If the funds are not returned, the situation would have substantially different consequences.
Were Liquid Network Private Keys Compromised?
One of the most important details released by Liquid is that the cryptographic authorization key involved in the withdrawal process was reportedly not compromised.
The withdrawals were conducted through SideSwap, a settlement service authorized to facilitate Liquid peg-out transactions.
Liquid said the relevant Peg-out Authorization Key, or PAK, had not been compromised, nor had other keys.
This makes the incident more technically complicated than a conventional wallet theft in which an attacker simply obtains a private key.
What Is Liquid Network?
Liquid Network is a Bitcoin sidechain designed for faster and more confidential settlement of bitcoin and other digital assets.
The network allows users to move value between the Bitcoin mainchain and Liquid through a two-way peg.
Bitcoin represented on Liquid is known as Liquid Bitcoin, or LBTC.
According to Blockstream documentation, LBTC is designed to be verifiably backed 1-to-1 by BTC held on the Bitcoin mainchain.
When BTC enters Liquid through a peg-in, an equivalent amount of LBTC can be created. When value leaves Liquid through a peg-out, the corresponding LBTC is destroyed and BTC is released from the federation wallet.
How Is Bitcoin on Liquid Secured?
Bitcoin held for the Liquid Network is not controlled through a single ordinary wallet key.
According to Blockstream's technical documentation, the Liquid Federation uses an 11-of-15 multisignature wallet to secure bitcoin held in the federation wallet and process peg-ins and peg-outs.
Fifteen Liquid functionaries each hold a key in specialized hardware security modules. A sufficient number of these functionaries must participate in the normal authorization process.
| Component | Purpose |
|---|---|
| BTC | Bitcoin held on the Bitcoin mainchain. |
| LBTC | Bitcoin representation used on the Liquid sidechain. |
| Liquid Federation | Group of Bitcoin-focused organizations participating in Liquid governance and operation. |
| 15 Functionaries | Specialized systems participating in block signing and securing federation bitcoin. |
| 11-of-15 Multisig | Normal multisignature structure securing bitcoin held by the federation. |
| Peg-in | Process of moving BTC from Bitcoin into Liquid. |
| Peg-out | Process of moving value from Liquid back to BTC. |
What Is a Peg-Out Authorization Key?
Liquid uses a system called the Peg-out Authorization Key list, commonly referred to as the PAK list.
Under the normal peg-out process, functionaries verify that the BTC destination is an approved or whitelisted address and confirm that the corresponding LBTC has been burned.
The federation then signs the Bitcoin transaction through its multisignature system.
This mechanism is designed to provide an additional security layer around movements of bitcoin out of Liquid.
Why Did Liquid Halt Transactions?
Liquid temporarily halted new transactions after discovering the incident.
Stopping network activity can help developers prevent additional problematic transactions while investigators determine exactly what happened.
The suspension may also affect wallets, exchanges and services that rely on Liquid while normal network functionality is unavailable.
Does This Mean Bitcoin Was Hacked?
No. The Liquid Network incident should not be confused with a compromise of the Bitcoin blockchain itself.
Liquid is a separate Bitcoin sidechain with its own federation, transaction rules and security model.
The Bitcoin mainchain continues operating independently of Liquid.
The incident involves Liquid Network infrastructure and bitcoin held through the Liquid Federation. It does not mean that the Bitcoin blockchain itself was hacked.
What Happens to LBTC?
LBTC is intended to remain verifiably backed 1-to-1 with BTC on the Bitcoin mainchain.
That makes the status of the withdrawn federation bitcoin particularly important because users depend on the relationship between BTC held by the federation and LBTC circulating on Liquid.
The ultimate impact will depend on what happens to the withdrawn bitcoin, whether the funds are returned and how Liquid resolves the underlying security issue.
Were Other Liquid Assets Affected?
Liquid can host assets other than LBTC, including stablecoins and other issued digital assets.
The reported incident specifically concerns bitcoin held by the Liquid Federation.
Even if another issued asset was not directly removed, users of the broader Liquid ecosystem may still experience disruption while the network is paused or services restrict transactions.
Why This Incident Matters for Crypto Security
The size of the withdrawal makes the Liquid incident important far beyond the network itself.
It illustrates how cryptocurrency security involves more than protecting a seed phrase or private key.
Sidechains, bridges, federation systems, software validation, authorization mechanisms and transaction logic can each create additional security considerations.
The incident may eventually become an important case study for developers working on Bitcoin sidechains and cross-network settlement technology.
What Should Liquid Users Do?
Users should rely on verified updates from Liquid Network, Blockstream and the exchanges or wallets they use rather than unverified social-media claims.
Users should also check whether their exchange or wallet has temporarily suspended Liquid deposits, withdrawals or other network functionality before attempting a transaction.
What Happens Next?
Several important questions remain.
Investigators need to determine the exact technical mechanism that allowed such a large withdrawal, establish the status of the bitcoin and determine whether the parties involved genuinely intend to act as security researchers.
Liquid will also need to explain how the issue will be fixed and under what conditions the network can safely resume normal transactions.
If the withdrawn bitcoin is returned and the underlying vulnerability is identified and repaired, the event could ultimately be treated as a major white-hat security disclosure.
If the funds are not returned, however, the financial and operational consequences could be substantially more serious.
Liquid Network Incident: Key Facts
| Question | Current Information |
|---|---|
| How much BTC was withdrawn? | Approximately 4,000 BTC. |
| Approximate value? | Around $320 million at the time of reporting. |
| How much BTC was reportedly held? | Approximately 4,200 BTC. |
| Who carried out the withdrawal? | Parties described by Liquid as purported white-hat hackers. |
| Was the PAK compromised? | Liquid said it was not compromised. |
| Were new transactions halted? | Yes, as a precaution following the incident. |
| Was Bitcoin itself hacked? | No evidence indicates a compromise of the Bitcoin blockchain. |
Frequently Asked Questions
How much Bitcoin was withdrawn from Liquid Network?
Liquid Network said approximately 4,000 BTC, valued at around $320 million at the time, was withdrawn from its federation wallet.
How much Bitcoin was held in the Liquid federation wallet?
The network reported that approximately 4,200 BTC was held before the incident.
Was Liquid Network hacked?
Liquid reported a major security incident involving unauthorized or exceptional withdrawals and described those responsible as purported white-hat hackers. The precise technical mechanism remains an important part of the investigation.
Was Bitcoin itself hacked?
No. The incident concerns Liquid Network, a Bitcoin sidechain. It does not represent a known compromise of the Bitcoin blockchain.
Were Liquid private keys stolen?
Liquid said the Peg-out Authorization Key involved in the withdrawal process was not compromised and that other keys were not compromised.
What is LBTC?
LBTC, or Liquid Bitcoin, is bitcoin represented on the Liquid sidechain and designed to be verifiably backed 1-to-1 by BTC held on the Bitcoin mainchain.
How does Liquid secure its bitcoin?
Blockstream documentation says the federation uses an 11-of-15 multisignature wallet, with keys held by Liquid functionaries using specialized hardware security modules.
Conclusion
The withdrawal of approximately 4,000 BTC from Liquid Network is one of the most significant cryptocurrency security incidents of 2026.
The case is especially unusual because Liquid says the relevant authorization key was not compromised while the parties responsible presented themselves as white-hat hackers.
The three major questions now are clear: what technical weakness allowed the withdrawal, whether the bitcoin will be returned and when Liquid Network can safely restore full operation.
NewsHub will update this report as additional verified information becomes available.
- Reuters — Liquid Network security incident and approximately $320 million Bitcoin withdrawal, September 7, 2026.
- Blockstream Help Center — What Is the Liquid Network?
- Blockstream Help Center — How Liquid Bitcoin (LBTC) Works.
- Blockstream Help Center — How the Liquid Federation Multisig Works.
Published: September 7, 2026 · This is a developing story and may be updated when additional verified information becomes available.
