Overview
- Liquid announced that roughly 4,000 of the ~4,200 BTC held in its federation wallet were withdrawn through what looked like a normal peg‑out that converted L‑BTC back to BTC.
- Independent analysis and transaction traces show a customer sent L‑BTC to SideSwap’s peg‑out service and about 23 minutes later the federation paid roughly 3,996 BTC to the Bitcoin mainchain, behavior analysts say may have been enabled by an Elements software bug.
- Liquid paused the sidechain and temporarily deactivated bridge nodes to stop new transactions, and connected exchanges suspended L‑BTC deposits and withdrawals while engineers work on fixes and node updates.
- The actor who moved the funds attached a message claiming to be a white‑hat and has offered to return most coins after a patch; one report says about 3,400 BTC have been returned and roughly 600 BTC remain in the attacker wallet, with talks ongoing.
- Because Liquid is a federated sidechain used by exchanges to speed Bitcoin settlement, the incident disrupts exchange operations and highlights risks in the Elements software layer even though Bitcoin and other Liquid assets such as USDT, DePix and RWAs appear unaffected.