Liquid Network hack: $320 million in bitcoin left the federation wallet, then most of it came back

A Sunday the Liquid federation won’t forget

On a Sunday, Liquid Network confirmed that roughly 4,000 BTC, worth about $320 million at the time, had left its federation wallet. The network’s operators called the people responsible “purported white-hat hackers” in a post on X. It was one of the largest single withdrawals in the history of any Bitcoin-adjacent protocol, and it got the attention of exchanges, institutional settlement desks, and security researchers within hours.

Liquid, originally built by Blockstream, is a federated sidechain: a rotating group of exchanges, market makers, and financial institutions run it, and it exists so users can settle Bitcoin faster and more privately than the base layer allows. The mechanism is a peg. Lock BTC into the federation’s multisig wallet, get L-BTC on Liquid, and redeem that L-BTC later to pull the underlying BTC back out. That multisig wallet, the one thing standing behind every L-BTC in circulation, is what got hit.

What the federation actually is

Bitcoin’s base layer gets its security from proof-of-work and tens of thousands of independent nodes. Liquid doesn’t work that way. A defined group of functionaries, historically including firms like Bitfinex, Kraken, and BTSE, hold keys to a shared multisig wallet, and a threshold of them has to sign off before any withdrawal goes out. No single member can move funds alone. That’s the whole point of the design.

Pegging in means sending BTC to a federation-controlled address; after confirmations and verification, the federation mints an equivalent amount of L-BTC. Pegging out reverses it: burn the L-BTC, and the federation releases BTC back to you from the vault. Everything rests on how well the federation manages its keys and how tightly it controls the withdrawal path. If that path breaks, it’s not one user’s problem. It’s the whole peg’s problem, and by extension the trust every institutional user has placed in Liquid since it launched in 2018.

How it happened: the SideSwap angle

Liquid’s disclosure pointed to SideSwap, a trading platform that had a sanctioned pathway to request peg-out transactions from the federation wallet. The detail that stood out: Liquid said the key used in the withdrawal was not compromised.

That distinction matters. Keys can be stolen outright, or key holders can be socially engineered, or signing infrastructure can get hit with malware, or the logic that builds and authorizes transactions can be exploited without anyone touching a private key at all. If the keys were fine, the problem sat somewhere in the authorization layer: SideSwap’s API, or the pipeline that constructs and validates withdrawal requests. Something let an unauthorized party submit a request that looked legitimate enough for the federation’s signing nodes to approve it.

Whoever did this took about 4,000 of the roughly 4,200 BTC in the wallet, leaving around 200 behind. Moving that much, that fast, without tripping a manual review, suggests they understood the federation’s operational rhythm and its withdrawal thresholds well before they acted.

The hackers negotiated on-chain

What made this incident unusual wasn’t the theft. It was what happened next. Instead of running the funds through mixers or bridges, the people who took the BTC started messaging Liquid’s team using Bitcoin transactions, embedding text in the OP_RETURN fields of small-value transactions sent to Liquid-associated addresses. It’s a slow way to communicate, but it’s public, permanent, and can’t be taken down.

Through those messages, they said they’d return the funds once the vulnerability was fixed. They framed themselves as security researchers who’d proven a flaw in the most direct way available. Liquid’s choice of the word “purported” says a lot about how the team saw the claim: the line between a white hat and a thief who’s offering good terms often comes down to how the story gets told, not to anything technical. Still, Liquid negotiated instead of going straight to law enforcement, which tells you they thought cooperation was more likely to get the money back than a legal fight spread across multiple jurisdictions.

This isn’t the first time something like this has played out. In 2021, the attacker behind the $611 million Poly Network bridge hack returned most of the funds after talking to the project team. Liquid’s version was more structured and happened entirely in public, on-chain, rather than through private back channels.

The resolution: 3,400 BTC back, 598.5 BTC kept

The hackers returned about 3,400 BTC, roughly 85 percent of what they took. They kept 598.5 BTC, worth about $47 million, which has been described as a bug bounty or a disclosure fee. A 15 percent cut isn’t far off from informal bounty norms in security research, though the fact that they took it themselves rather than negotiating a separate payout is still a sticking point for a lot of security and legal people watching this unfold.

The BTC came back in tranches, and on-chain observers tracked it in real time. Every return transaction traced clearly back to the addresses that received the original stolen funds, so there’s a clean audit trail. Once the money landed back in the federation’s multisig, the peg backing L-BTC was restored and Liquid resumed operations, with more manual review and anomaly detection built into withdrawal approval than before.

Legally, the 598.5 BTC is messy. Taking funds without authorization is theft or computer fraud almost everywhere, regardless of intent or later restitution. But cross-border enforcement in crypto is slow and expensive, and getting most of the money back fast is often worth more to the affected party than pursuing charges that might go nowhere. Calling the actors “purported white-hat hackers” rather than “thieves” was a deliberate choice on Liquid’s part, one that kept the door open to a negotiated outcome without inviting the full weight of a criminal investigation.

What the freeze meant for users

Liquid halted all sidechain transactions as soon as the hack was confirmed. Every L-BTC holder and every institution using Liquid for settlement felt it. The network apologized publicly and warned that wallets would be affected.

The freeze wasn’t optional. With the withdrawal path still exploitable and the scope of the bug unknown, letting transactions continue risked more unauthorized withdrawals or a mess in the peg’s accounting. During the halt, the federation’s engineers audited the withdrawal authorization pipeline, SideSwap’s integration, and the signing protocols federation members use, looking not just for the specific exploit but for anything else that might have slipped through the original design review.

For users, that meant no pegging in or out, no trading on Liquid-based exchanges, and no moving L-BTC between wallets until the freeze lifted. Institutions with pending settlements were stuck. It’s a real demonstration of the trade-off: federated sidechains are faster and more private than Bitcoin’s base layer, but a single broken pathway can force the whole network to stop.

What probably went wrong

Liquid hasn’t published a full post-mortem, so this is inference, not confirmed fact. Given that SideSwap was the vector and the key wasn’t touched, the likely failure point is the authorization layer. Federation withdrawals normally start when an authorized party submits a transaction template, and the signing nodes check it against policy: is the requester authorized, is the amount within limits, is the destination valid, has this request already been processed.

A few things could have broken that check. An authentication flaw in SideSwap’s API could have let someone submit requests that looked like they came from SideSwap’s own systems. A race condition in the transaction-construction logic could have let one legitimate request get duplicated and processed more than once. Or the quorum verification itself might have had a gap, letting a subset of signing nodes approve a batch withdrawal without full federation awareness.

Draining 4,000 of 4,200 BTC in one coordinated move points toward batch processing that slipped past whatever anomaly detection Liquid had in place. A withdrawal that size should have triggered manual checkpoints. Either the attackers knew the federation’s procedures well enough to move around them, or the exploit stayed under the threshold those systems were watching for.

The Liquid Network Hack: Technical Breakdown

The Liquid Network hack resulted in the theft of approximately 3,998.67 BTC (~$320 million) due to a critical vulnerability in the underlying Elements codebase’s handling of Confidential Transactions (CT). The exploit allowed attackers to mint L-BTC out of thin air and peg it out to the Bitcoin mainchain.

The Cryptographic Foundation

Liquid uses Confidential Transactions to hide amounts, requiring two cryptographic proofs to ensure validity without revealing values:

• Balance Proof: Verifies that the sum of blinded inputs equals the sum of blinded outputs.
• Range Proof: A zero-knowledge proof ensuring every output amount is positive (between 1 and $2^{64}-1$ sats). This prevents the “Negative Output Attack,” where an attacker hides a massive negative amount (e.g., -3,999 L-BTC) to offset and mint a massive positive amount (e.g., 4,000 L-BTC).

Because range proofs are computationally expensive, Elements implements a rangeproof memoization cache to skip redundant verifications.

The Root Cause: A Tale of Two Bugs

The vulnerability was not a simple flaw but a cascading failure involving a botched fix in the CachingRangeProofChecker component (src/script/sigcache.cpp).

• Bug A (The Original 2019 Bug): The cache key was derived only from the rangeproof bytes and the value commitment. It omitted the asset generator and the scriptPubKey. This meant a valid proof for one asset or script context could erroneously validate a completely different context.
• Bug B (The Fatal 2026 Fix): On August 3, 2026, a developer committed a patch titled “fix: range proof cache bind to asset and scriptpubkey”. However, this fix introduced a severe ambiguous key encoding error. The new cache key was computed as a salted hash of the raw concatenation: proof ‖ commitment ‖ asset-generator ‖ scriptPubKey, without length delimiters.

The Exploit Mechanism: Byte-Level Cache Collision

Because the proof and scriptPubKey are both variable-length fields sitting at opposite ends of the byte stream, an attacker could mathematically shift bytes across the boundary to create two distinct transactions that produced the exact same cache key hash.

1. The Primer: The attacker broadcast a valid transaction containing a legitimate rangeproof and an unspendable OP_RETURN script. The node verified the proof and stored the resulting hash in its volatile memory cache.
2. The Attack: The attacker broadcast a second, malicious transaction. By shifting bytes from the end of the “primer” proof into the OP_RETURN script payload, they created a new tuple with a completely different, invalid rangeproof. Crucially, the concatenated byte stream remained byte-identical.
3. The Bypass: Nodes found a cache hit for the malicious transaction and skipped the expensive cryptographic verification entirely. This allowed the attacker to pass an output committing to a massive negative value (which mathematically cannot have a valid rangeproof) as valid.
4. Minting: The attacker balanced this negative output with a validly proven, massively inflated positive output in the same transaction, successfully minting millions in new L-BTC.

The Peg-Out and Aftermath

Within minutes, the attacker laundered the inflated L-BTC into sendtomainchain transactions.

• Peg-Out: The Liquid Federation functionaries processed the withdrawals, sending 3,998.67 BTC to the Bitcoin mainnet.
• Volatility: The cache is stored in RAM; a simple node reboot would have cleared the poisoned cache and prevented the collision.
• SideSwap: SideSwap confirmed the exploit originated entirely from the Elements bug, not their exchange infrastructure.
• “White Hat” Claim: The attackers claimed to be white hats and promised to return the funds once the vulnerability was fully patched.

Answers to Open Questions

1. How did the exploit happen before the fix was widely deployed?
The original fix was committed on Aug 3, 2026, and a PR was opened on Sept 1. However, no official release tag was issued. More importantly, the patch itself was flawed: it introduced the “boundary shift” vulnerability (Bug B). Even nodes that applied the August patch remained vulnerable because the fix failed to use length delimiters in the cache key.

2. Why did Sideswap/Federation allow the huge peg-out?
The federation lacked automated sanity checks for daily peg-out limits and had no manual review process for anomalous, massive withdrawals. While federation members have the power to restrict peg-outs, the protocol automation allowed the transaction to proceed without triggering human intervention.

3. Why did the Blockstream Explorer reject the transaction?
The official Liquid Explorer likely remained unaffected because it was running an older version (e.g., v23.3.2) that only contained Bug A. The specific byte-shifting attack (Bug B) only works against the flawed August 3rd fix. Additionally, the explorer’s cache may have been reset more frequently, preventing the “primer” transaction from lingering in memory long enough to be exploited.

4. Why did the bug sit unexploited for 7 years?
The complexity of zero-knowledge proofs and memory management in C++ allowed the original omission (Bug A) to persist. Interestingly, GitHub Copilot’s “Fable5” AI reportedly identified the original bug using a simple “spot anything erroneous with this?” prompt on the caching PR, highlighting how AI-assisted code review might have caught this years earlier.

What this means for sidechains and federated models

Liquid isn’t the only project extending Bitcoin’s functionality. Lightning, Rootstock, and Stacks all take different approaches, and each carries its own trust assumptions. Bitcoin maximalists have argued for years that any move away from permissionless proof-of-work consensus brings counterparty risk that shouldn’t exist. This hack is evidence for that argument.

It’s also evidence the federated model can survive a serious hit. The peg got restored, L-BTC holders didn’t lose their backing, and that happened because of the relationships and negotiation channels that already existed within the federation. Without the white-hat framing and the on-chain back-and-forth, this could have gone very differently: a permanent loss, a de-peg, L-BTC worth nothing.

The bigger lesson for anyone running a system that custodies funds: key security isn’t enough on its own. API access controls, withdrawal rate limits, multi-party approval for large transactions, real-time anomaly detection, and regular penetration testing of every integration point all need the same level of attention as the keys themselves. And when something like this happens, staying quiet is its own kind of damage. Users need information, not silence.

How the industry reacted

Researchers picked apart the on-chain data almost immediately, tracing the withdrawn BTC through the mempool and arguing over whether the white-hat framing was earned. Some Bitcoin developers pointed to the hack as proof that base-layer security, where no small group controls fund movement, is the model that actually holds up. Others argued the opposite: that federated systems need better standards, not abandonment.

Exchanges and market makers using Liquid reviewed their own integration points and withdrawal procedures. Several pushed for lower withdrawal limits, mandatory multi-party approval above certain thresholds, and time-locked withdrawals that would build in a delay before funds actually move, giving anomaly detection a window to catch something before it’s final.

Security firms that looked at the incident noted it fit a pattern: sophisticated attacks increasingly target the business logic and API layer around a system rather than its cryptography. No keys were stolen here, and funds still moved. That gap, between key security and everything else that governs how keys get used, is where a lot of organizations are exposed.

Where things stand

Liquid resumed transactions with tighter withdrawal authorization, and SideSwap’s integration went through a full security review that restructured its role in the withdrawal pipeline. The legal question of how to classify the event, theft, fraud, extortion, something else, remains open, and probably depends on which jurisdictions get involved and whether the people behind it are ever identified. The white-hat framing and the 85 percent return don’t map cleanly onto existing law.

Several Bitcoin projects have since announced independent security reviews of their own bridge and federation mechanisms, and industry groups have started drafting best-practice guidelines for federated sidechains based on what happened here.

What it means for developers, operators, and users

If you build or run a federated or multisig system, the takeaway is that security is a system-level property, not just a cryptographic one. Protecting keys is the baseline. The real work is in the authorization logic, the API integrations, and the batch-processing paths, every one of which is a potential attack surface that needs testing and monitoring on its own.

If you use a federated sidechain or any custodial platform, this is a reminder that any system built around a federation or a multisig quorum carries trust assumptions Bitcoin’s base layer doesn’t have. Know who holds the keys, know what happens if something goes wrong, and don’t put everything in one place.

For security researchers, this raises a real question about disclosure ethics. Proving a $320 million exploit by actually moving the money, instead of reporting it privately and letting the team patch it first, put real funds at risk for however long the negotiation took. The money came back, but the approach sets a precedent, and not everyone in the security community is comfortable with where that precedent points if the next bounty-seeker decides to go bigger.

Where this leaves Liquid

The peg is intact, the federation has tightened its security, and the 598.5 BTC that didn’t come back, about $47 million, is the price of finding out about this vulnerability before someone less willing to negotiate did. Had a less cooperative actor found the same flaw, the federation wallet could have been wiped out entirely, and L-BTC could have collapsed with it.

Whether the next person to find a flaw like this chooses to negotiate, or just takes the money and disappears, is the open question. Liquid’s response to this one gives some indication of how the network would handle it again. Whether that’s good enough is something the federation, and its users, will keep finding out.

This piece will get updates as more details on the SideSwap vulnerability, the federation’s audit, and the retained funds become available. Check official Liquid Network channels and public block explorers for the latest.