Blockstream's Liquid sidechain paused operations Sunday following the withdrawal of nearly all bitcoin held in its federation wallet. Approximately 3,998.5 BTC exited the network in a single transaction, with the recipient identifying themselves on-chain as "white hats."
The withdrawal, valued at about $320 million at current market rates, used a working authorization key—specifically a SideSwap Peg-out Authorization Key (PAK), the mechanism designed for withdrawing pegged bitcoin from the sidechain.
Prior to the incident, the Liquid federation wallet held roughly 4,200 BTC, serving as collateral for LBTC, the network's native pegged bitcoin. After the transaction, the federation's holdings dropped to 207.275 BTC, representing a significant de-pegging event.
Exchanges have suspended deposits and withdrawals of LBTC following the pause. Blockstream has begun efforts to establish communication with the entity responsible for the withdrawal but has not released an official statement addressing the on-chain message claiming "white hat" intentions.
The Liquid Network operates as a Bitcoin sidechain offering faster and more confidential transactions. Its federation wallet relies on a multi-signature custody model where a collective of trusted entities secures the underlying BTC reserves.
The use of a legitimate authorization key for such a substantial outflow raises questions about the federation's access management and security protocols around the peg-out process. While the withdrawing party claims a "white hat" operation, the forced network pause signals a critical security event.
This represents one of the largest single withdrawals from a Bitcoin sidechain by both BTC volume and dollar value. Resolution will require verification of the "white hat" claims and a clear path forward for restoring network functionality.
