Liquid Network, a Bitcoin-based payments and settlement network, has halted new transactions after attackers withdrew roughly $320 million in bitcoin from its federation wallet, raising fresh questions about the security architecture behind sidechains and federated custody.
Reuters reported that around 4,000 of the 4,200 bitcoin stored in the Liquid Federation wallet were withdrawn during the incident. Liquid described those responsible as “purported white-hat hackers,” a term generally used for security researchers who identify vulnerabilities rather than attackers seeking permanent financial theft.
UA.News likewise reported the withdrawal of about $320 million during the Liquid Network hack, putting the scale of the incident among the more significant recent security failures affecting cryptocurrency infrastructure.
Liquid pauses transactions after massive withdrawal
The immediate response has been to stop additional activity while the incident is investigated.
According to Reuters, Liquid Network said new transactions had been halted and Liquid wallets would be affected. The company apologized for the disruption as it worked through the consequences of the withdrawal.
The funds moved through SideSwap, a settlement platform authorized to process withdrawals from Liquid. However, the cryptographic key used for the withdrawal was not compromised.
That detail is technically important because it suggests the incident cannot be explained simply as an attacker stealing an authorized withdrawal key. Instead, the failure may involve how different parts of Liquid’s transaction and settlement architecture interacted.
Nearly all of the federation’s bitcoin was affected
The numbers also expose the concentration of risk inside the system.
With roughly 4,000 BTC withdrawn from a federation wallet containing about 4,200 BTC, approximately 95% of the reported bitcoin reserves in that wallet were involved in the incident.
Liquid Network operates as a Bitcoin sidechain designed to support faster settlement and asset transfers than relying exclusively on the Bitcoin main chain. Its architecture therefore depends on infrastructure that bridges assets between Bitcoin and the separate Liquid environment.
The incident demonstrates why those bridges and settlement mechanisms can become especially sensitive security boundaries. A blockchain may itself operate correctly while vulnerabilities elsewhere in the surrounding infrastructure create routes for assets to leave the system.
Sidechain security depends on more than private keys
For developers building blockchain infrastructure, the most important detail may be that Liquid said the relevant SideSwap key had not been compromised.
Security models often place enormous emphasis on protecting cryptographic keys. But complex financial systems depend on additional layers: authorization logic, software implementations, bridge mechanisms, transaction validation and assumptions about how different components interact.
When any of those layers fail, possession of intact private keys does not necessarily guarantee that funds are safe.
The Liquid incident therefore illustrates a broader infrastructure lesson. For systems holding hundreds of millions of dollars in digital assets, security cannot stop at protecting credentials or auditing smart contracts individually.
Builders also need to understand how the entire transaction path behaves when one component does something unexpected—because in financial infrastructure, a flaw in that path can turn into hundreds of millions of dollars moving before anyone can stop it.
