# @Liquid_BTC: white-hat hackers withdrew 4,000 BTC from Liquid Federation wallet

Source: https://x.com/liquid_btc/status/2096696272447218108
Kiwi News: https://news.kiwistand.com/stories/LiquidBTC-white-hat-hackers-withdrew-4000-BTC-from-Liquid-Federation-wallet?index=0x6a9dd85d8a9704f119a908578533d59568754677d4340457394ade2cb043415ae63641b4
Submitted by misha on 2026-09-06 UTC, 2 upvotes, 0 comments

## Summary

Liquid Federation's sidechain has been paused after purported white-hat hackers withdrew about 4,000 BTC (about $320 million) from its wallet. The incident is linked to the SideSwap PAK (Peg-out Authorization Key), which the article says was used for the withdrawal but was not compromised, nor were any other keys. Exchanges have paused or will pause LBTC deposits and withdrawals, and bridge nodes have been temporarily disabled, so no new transactions can be submitted. Blockstream is working to contact the hackers on-chain with a signed message, and Federation members are working to restore normal network activity.

## Article

We are aware of a security incident on @Liquid_BTC. Purported white-hat hackers have withdrawn ~4,000 BTC (~$320 million) from the Liquid Federation wallet. The @Blockstream team is working on contacting them on-chain with a signed message.

What we know so far is that the funds were withdrawn via the SideSwap PAK (Peg-out Authorization Key), but that key was not compromised, nor were any others.

Exchanges have been notified and have already paused (or will pause) LBTC deposits and withdrawals. Other Liquid assets such as USDT, DePix, and RWAs are unaffected by this security incident.

Bridge nodes have been temporarily disabled, so no new transactions can be submitted to the network. Effectively, the Liquid sidechain is paused until this issue is resolved.

Liquid wallets will be impacted, and we're sorry for any inconvenience. Federation members are actively working on resolving this so we can restore normal network activity.

You can monitor the situation via @mempool's http://liquid.network site below:

https://mempool.space/address/bc1qdlld6antmv4xug242ed83q7k4rqw50cwfns38szx4qu2f4jwaxxsuhwxxr