IXIDE: Liquid Network Halts Operations After 4,000 BTC Withdrawal
One of the biggest crypto infrastructure incidents in recent days has involved Liquid Network — a Bitcoin sidechain used for faster transfers and settlements between participants in the crypto market.
Around 4,000 BTC worth approximately $320 million was withdrawn from Liquid’s federated wallet. This represented about 95% of the network’s Bitcoin reserve, which had previously held around 4,200 BTC. After the incident, Liquid temporarily paused new transactions, and several platforms suspended deposits and withdrawals of LBTC.
What Is Liquid Network?
It is important to clarify right away: the Bitcoin network itself was not hacked.
Liquid is a separate Bitcoin sidechain developed by Blockstream. It allows BTC to be moved between participants more quickly and uses LBTC, a token backed by Bitcoin locked on the main network.
Liquid is used by exchanges, infrastructure companies and other professional market participants. The federation behind the network includes more than 80 organizations.
So the incident affected Liquid’s infrastructure, not the core Bitcoin blockchain.
What Happened?
According to Liquid, around 4,000 BTC was withdrawn from its federated wallet.
After the issue was detected, the network temporarily halted new transactions, and bridges were disabled while the situation was being investigated.
Exchanges and other participants in the ecosystem also began suspending LBTC-related operations.
At the same time, Liquid stated that the federation’s keys had not been compromised.
According to later information from Blockstream, the cause may have been a software bug in Elements, the software foundation on which Liquid operates. The funds reportedly moved through SideSwap, meaning through the network’s normal permitted infrastructure.
Why Is Everyone Talking About “White-Hat Hackers”?
The most unusual part of the story is that the people behind the withdrawal claim to be white-hat hackers.
They said through blockchain messages that they are prepared to return the funds once the vulnerability has been fixed.
According to reports, one of their messages essentially stated that the bug should be fixed and all nodes updated first, after which the Bitcoin would be returned.
At this stage, however, there is still no guarantee that the funds will actually be returned.
Why Is the Amount So Large?
Before the incident, Liquid held around 4,200 BTC in reserve.
The withdrawal of roughly 4,000 BTC means that almost the entire Bitcoin liquidity base of the system was affected.
That is what makes the situation especially serious: this is not simply a case of one wallet being compromised, but a problem affecting the mechanism that supports LBTC inside the sidechain.
What About Other Assets?
Liquid is not used only for LBTC.
USDT and other digital assets are also issued on the network.
According to Liquid, other assets were not directly affected, but the operation of wallets and the network itself was disrupted because the sidechain was paused.
So the issue currently concerns Liquid infrastructure and LBTC first and foremost, not USDT on other networks such as TRC20 or ERC20.
Does This Mean Bitcoin Is Unsafe?
No.
This is a very important distinction.
The incident occurred not on the main Bitcoin blockchain, but in additional infrastructure built around it.
Bitcoin itself continues to operate normally.
Situations like this show that the safety of digital assets depends not only on the underlying blockchain, but also on which network, bridge, sidechain, exchange or service a user is interacting with.
What Does This Mean for IXIDE Users?
For IXIDE users, this is a good example of why it is important to check not only the name of an asset, but also the network being used.
The same Bitcoin or USDT may exist within different infrastructures, and the risks of those infrastructures can vary significantly.
Before making an exchange, it is worth paying attention to:
the selected network;
the receiving address;
the current network status;
any temporary restrictions;
the current order status;
transaction confirmation through TXID.
If a specific network or service has temporarily paused operations, it is safer to wait for normal operation to resume instead of attempting to send funds through alternative methods without proper verification.
What Happens Next?
The main questions now are whether the vulnerability will be fully fixed and whether the alleged white-hat hackers will действительно return the approximately 4,000 BTC.
Blockstream and participants in the Liquid federation are working on fixing the issue and restoring the network, but exact timelines for a full recovery have not yet been announced.
If the funds are returned, this incident could go down as one of the largest white-hat events in crypto history.
If not, it may become one of the most serious infrastructure incidents of the year.
IXIDE Opinion
At IXIDE, we believe the most important part of this story is not just the $320 million figure.
What it really highlights is the difference between the security of the base blockchain and the security of the services built around it.
Bitcoin itself may continue operating normally, while a bridge, sidechain or another layer of infrastructure can still have its own vulnerabilities.
That is why, when working with digital assets, it is important to understand which exact network is being used, check the current status of the infrastructure and use only those exchange directions that are fully available and operating normally.