H1: Liquid Network 4,000 BTC Incident: What Is Known About the SideSwap PAK Peg-Out
Liquid Network is investigating one of the largest bridge-reserve security incidents of 2026.
On September 6, roughly 4,000 BTC was withdrawn from the federation wallet backing Liquid Bitcoin (L-BTC). At the time, the BTC was worth approximately $320 million.
The withdrawal represented about 95% of Liquid’s reported bitcoin reserves, which had stood near 4,200 BTC before the incident.
What Liquid has confirmed
Liquid’s public statement says:
- a security incident occurred;
- approximately 4,000 BTC was withdrawn;
- the withdrawal used the SideSwap Peg-out Authorization Key;
- the SideSwap PAK itself was not compromised;
- no other federation keys were believed compromised;
- bridge nodes were disabled;
- exchanges were notified to suspend or prepare to suspend L-BTC deposits and withdrawals;
- the sidechain was effectively paused while the issue is investigated.
That combination is unusual: an authorization path was successfully used even though Liquid says the relevant key was not stolen.
What “PAK” means
A Peg-out Authorization Key is part of Liquid’s mechanism for authorizing BTC withdrawals from the federation reserve when L-BTC is redeemed back to mainchain bitcoin.
The security problem is therefore not simply that a private key leaked.
The more important question is:
How was a peg-out authorization path satisfied without the key itself being compromised?
Liquid has not yet publicly explained that mechanism.
The “whitehat” claim
A bitcoin transaction associated with the incident carried an OP_RETURN message stating:
“we are whitehats. contact us on chain.”
That message proves the actor controlling the relevant BTC could sign the transaction carrying the message.
It does not prove the actor is an ethical security researcher.
CEXVia therefore uses: Purported whitehat / identity unconfirmed
rather than: Confirmed whitehat
Why L-BTC backing matters
L-BTC is designed to represent BTC locked under Liquid’s federation model.
If the reserve BTC is removed, the immediate risk is not only the value of the missing bitcoin. It is also whether circulating L-BTC remains reliably redeemable 1:1.
Liquid has paused bridge activity while the issue is resolved.
That makes this both a security incident, a reserve-backing event and an asset-access event.
Other Liquid-issued assets
Liquid said other assets issued on the network, including USDT, DePix and real-world assets, were not directly affected by the security incident.
However, network-level disruption can still affect transfers and wallet functionality even when an asset’s own issuer reserve is not compromised.
Evidence Status
Confirmed / Official + On-chain
- Roughly 4,000 BTC withdrawn.
- Approx. $320M value at incident time.
- Roughly 95% of reported reserves.
- SideSwap PAK used.
- Liquid says PAK and other keys were not compromised.
- Bridge nodes disabled.
- L-BTC deposits/withdrawals suspended or being suspended at exchanges.
- Sidechain effectively paused.
Developing
- Exact root cause.
- Whether the actor is truly whitehat.
- Whether all BTC will be returned.
- Final reserve deficit.
- Restart timing.
- Exchange reopenings.
Risk Assessment
Critical.
What to Watch Next
BTC movement, signed communication with the actor, fund return or bounty terms, technical root-cause disclosure, L-BTC reserve reconciliation, exchange reopenings and bridge restart.
FAQ
How much BTC was withdrawn?
Approximately 4,000 BTC.
Was the SideSwap key stolen?
Liquid says the PAK itself was not compromised.
Are the actors confirmed whitehats?
No.
Is L-BTC fully redeemable right now?
Bridge activity has been paused.
Were Liquid USDT and RWAs stolen?
Liquid says those other issued assets were not directly affected.
Has the money been returned?
No return was confirmed in the material reviewed for this update.