Liquid Network pauses after ~4,000 BTC leave wallet

Blockstream posted a status-page incident titled Liquid Security Incident on 7 September 2026. It says purported white-hat hackers withdrew about 4,000 BTC, about $320 million, from the Liquid Federation wallet. Public bridge nodes are the affected component, and the incident is listed as active.

This is an official service-status notice. It is not a confirmed recovery of the coins, not a law-enforcement charging document, and not a finding that the actors are white hats. That label is their self-description.

The funds left via the SideSwap Peg-out Authorization Key, and Blockstream says that key was not compromised, nor were any others. That is the operational distinction most one-line takes skip. Exchanges have been notified and have paused, or will pause, L-BTC deposits and withdrawals. Other Liquid assets such as USDT, DePix, and RWAs are unaffected.

Bridge nodes have been temporarily disabled, so no new transactions can be submitted. The Liquid sidechain is effectively paused. Blockstream is contacting the recipients on-chain with a signed message, and federation members are working to restore normal activity.

On-chain colour from The Crypto Times puts the move at about 3,996 BTC, with federation reserves falling from about 4,200 BTC toward about 197 BTC, roughly 95 percent. The same reporting says an on-chain message claimed a return after a patch. As of morning 7 September coverage, the coins had not been confirmed returned.

Treat the incident as open. White hat is unverified, and the status page does not say the funds are back.

USDT still circulating on Liquid is the same kind of live stablecoin book that Treasury's GENIUS Act Section 3 NPRM and the MAS payment-services consultation are trying to write rules for. Tokenized RWAs on the chain sit next to the SEC transfer-agent rewrite. Anyone with a UK tax lot in L-BTC still has to apply the HMRC crypto capital-gains guidance even while the peg is paused.

If you hold L-BTC, run a Liquid peg desk, or list LBTC pairs, treat deposits and withdrawals as halted, do not assume USDT or RWAs on Liquid are frozen, and do not mark the 4,000 BTC as recovered until Blockstream updates the incident to say so.