A security breach on September 6 drained nearly 4,000 BTC, worth about $320 million, from Liquid Federation's Bitcoin wallet via a peg-out the network says it did not authorize. The withdrawal was signed with SideSwap's peg-out authorization key, which Liquid says was not compromised, leaving the exact control-path failure unresolved. The incident is testing user confidence in federated sidechain custody as Blockstream advances a BitVM bridge model.
Nearly 4,000 BTC, about $320 million, left Liquid Federation's Bitcoin wallet on September 6 through a peg-out the sidechain operator says it did not authorize.
Liquid said in a post on X that "purported white-hat hackers" had withdrawn the coins and that Blockstream was trying to contact them on-chain with a signed message. The party behind the transfer left an OP_RETURN reading "we are whitehats. contact us on chain" in the Bitcoin transaction "c103de…e69a19," according to mempool.space.
On-chain data shows the payout transaction "8db751…a7b140" sent roughly 3,996 BTC to the address "bc1qgs…c6wt7p," confirmed in Bitcoin block 965,783 at 14:28:56 UTC on September 6, per ErgoBTC. Blockstream's explorer shows the associated Liquid transaction "ce4cae…e988f2" involving a 3,996.01834922-LBTC peg-out.
Liquid claims the withdrawal employed SideSwap's peg-out authorization key (PAK), even though the SideSwap PAK was not breached. The PAK is designed so that "even if a set of functionaries were compromised, they couldn't redirect user funds to attacker-controlled addresses," according to Liquid's developer documentation. If the valid SideSwap PAK was used and the key was not compromised, the open question is where in the control path the failure occurred. Liquid's Strong Federation model requires a greater than two-thirds watchman threshold to spend Bitcoin held by the Federation, per its technical documentation.
It would be hasty to classify the actors as white hats on the basis of their assertion alone. A comparable case — TAC, a protocol for decentralized cross-chain transactions — was only reclassified as a white-hat operation after the hacker accepted a 10 percent cut and returned the remainder of roughly $2.8 million, per earlier reporting.
The bigger test is confidence in federated bridges. TRM Labs' H1 2026 report found that infrastructure and operations vulnerabilities accounted for about 15 percent of incidents but 76 percent of total losses in dollar terms, indicating custody and bridge disruptions can outweigh months of smaller exploits. A July 2026 paper by Heritage Falodun and Samson Ojo notes only about 0.8 percent of circulating BTC is used in DeFi, versus up to 30 percent of Ethereum, citing trust and institutional infrastructure as the main barriers. Blockstream's May roadmap emphasizes reducing reliance on trust-based schemes and is developing a BitVM 1-of-n bridge model — work whose significance grows if federated designs keep producing incidents like this.
Whether the nearly 4,000 BTC are returned, parked, or moved to exchanges remains to be seen. Moving BTC on-chain does not itself create selling pressure; that depends on whether the funds reach exchanges, and no evidence has been cited that they have. For now the situation is a test not just of Liquid's security but of the trust Bitcoin users place in federated bridges.
This article is for informational purposes only and does not constitute investment advice.
