Bitcoin-Linked Liquid Network Hit by $320 Million Hack as Crypto Security Concerns Intensify
A major security incident has struck the Bitcoin-linked Liquid Network, with approximately 4,000 Bitcoin worth around $320 million withdrawn from its federation wallet. The incident has forced the network to halt new transactions and has raised fresh concerns about vulnerabilities in the infrastructure used to move digital assets between major cryptocurrency platforms.
Liquid Network said the withdrawal involved roughly 4,000 of the 4,200 Bitcoin held in its Liquid Federation wallet. That means approximately 95% of the Bitcoin reserves associated with the wallet were removed, making the incident one of the most significant crypto-security events reported in 2026.
The network described the attackers as “purported white-hat hackers.” In cybersecurity, white-hat hackers generally identify vulnerabilities with the stated intention of preventing malicious exploitation. However, Liquid has not initially provided independent confirmation that the actors were acting legitimately or that the funds will ultimately be returned.
An on-chain message associated with the incident reportedly claimed that the attackers were white hats and sought contact with network operators. Subsequent reporting indicated that the actors had communicated with Blockstream and said they intended to return most of the Bitcoin after a vulnerability was addressed. The precise circumstances remain under investigation.
Liquid has also stressed that the cryptographic key used in the withdrawal was not compromised. The funds were moved through SideSwap, a settlement platform authorized to process withdrawals from the network. This makes the incident particularly significant because investigators must determine how an apparently valid withdrawal mechanism could be used to remove such a large portion of the reserves.
Following the attack, Liquid disabled bridge nodes and halted new transactions as a precaution. Exchanges using Liquid have also suspended, or prepared to suspend, deposits and withdrawals involving L-BTC, the network’s Bitcoin-backed asset. The disruption means that users and institutions relying on Liquid for rapid settlement may temporarily face restrictions on moving funds.
Liquid is a Bitcoin sidechain and settlement network developed to allow faster and more efficient transactions than those conducted directly on the Bitcoin main network. It is particularly relevant to cryptocurrency exchanges and other financial infrastructure providers that use it for transferring Bitcoin-based assets.
The network was introduced by Blockstream in 2018 and is operated through a federation involving exchanges, infrastructure providers and asset managers. Its design allows actual Bitcoin to be locked while corresponding Liquid Bitcoin, or L-BTC, is used within the Liquid ecosystem.
That architecture is now at the centre of the investigation. Early security analysis has pointed toward a potential vulnerability in the system governing Bitcoin peg-outs, although the precise technical root cause has not yet been conclusively established by Liquid or Blockstream.
The scale of the withdrawal is particularly alarming because the incident did not simply affect an individual investor or a single cryptocurrency exchange. It targeted infrastructure sitting underneath a broader network of digital-asset activity. The attack therefore highlights how vulnerabilities in intermediary systems can potentially affect large pools of assets even when the underlying Bitcoin blockchain itself has not been breached.
The incident also comes amid a wider period of heightened concern over cryptocurrency security. Recent attacks against digital-asset platforms have demonstrated that investors can face significant risks not only from volatile token prices but also from vulnerabilities in wallets, bridges, settlement systems and other infrastructure surrounding blockchains.
For Liquid users, the immediate priority is determining whether the withdrawn Bitcoin can be recovered and identifying the vulnerability that enabled the transaction. Network operators are working to contact the parties responsible while keeping transactions paused to prevent further losses.
The episode is also likely to intensify debate over the security model of federated and sidechain-based Bitcoin systems. While such networks can provide faster transactions and additional functionality, they introduce additional technical layers between users and the Bitcoin mainchain. A vulnerability in those layers can therefore create risks that do not exist in a straightforward Bitcoin transaction.
For the wider cryptocurrency industry, the $320 million Liquid incident is another reminder that blockchain security extends far beyond the underlying ledger. As billions of dollars move through exchanges, bridges, custody systems and settlement networks, the weakest component in that infrastructure can become a target for attackers.
The ultimate significance of the incident will depend on what investigators discover about the vulnerability, whether the Bitcoin is returned and whether Liquid can safely restore normal operations. Until those questions are resolved, the attack remains a major warning for exchanges and digital-asset institutions that rely on third-party blockchain infrastructure for the movement and custody of large amounts of cryptocurrency.
