Liquid Network pauses after ~4,000 BTC leave wallet

Blockstream said purported white-hat hackers withdrew about 4,000 BTC, about $320 million, from the Liquid Federation wallet. The company posted a status-page incident titled Liquid Security Incident on 7 September 2026. Public bridge nodes are the affected component, and the incident is listed as active.

The notice is Blockstream's own service-status update, not a confirmed recovery of the coins, a law-enforcement charging document, or a finding that the actors are white hats. That label is their self-description.

The funds left via the SideSwap Peg-out Authorization Key, and Blockstream says that key was not compromised, nor were any others. That is the operational distinction most one-line takes skip. Exchanges have been notified and have paused, or will pause, L-BTC deposits and withdrawals. Other Liquid assets such as USDT, DePix, and RWAs are unaffected.

Bridge nodes have been temporarily disabled, so no new transactions can be submitted. The Liquid sidechain is effectively paused. Blockstream is contacting the recipients on-chain with a signed message, and federation members are working to restore normal activity.

On-chain colour from The Crypto Times puts the move at about 3,996 BTC, with federation reserves falling from about 4,200 BTC toward about 197 BTC, roughly 95 percent. The same reporting says an on-chain message claimed a return after a patch. As of morning 7 September coverage, the coins had not been confirmed returned.

USDT still circulating on Liquid is the same kind of live stablecoin book that Treasury's GENIUS Act Section 3 NPRM and the MAS payment-services consultation are trying to write rules for.

The incident remains open. White hat is unverified, and the status page does not say the funds are back.