Blockstream's Liquid Network Hit by $320 Million Bitcoin Withdrawal Exploiting Inflation Bug

Blockstream's Liquid Network, a federated Bitcoin sidechain, confirmed that purported white-hat hackers withdrew about 4,000 bitcoin from the federation wallet backing its L-BTC token. The attackers appear to have exploited an inflation bug that allowed them to create thousands of LBTC that never legitimately existed, then redeem it for real bitcoin held in the federation's treasury. Because the fraudulent transaction looked valid under the network's rules, the federation's signing servers approved the withdrawal.

The stolen funds were moved to a new address, with the attackers leaving an on-chain message claiming to be white-hat hackers and asking to be contacted. Other assets issued on Liquid, including USDT, DePix and various real-world assets, were reportedly unaffected. In response, Blockstream paused bridge nodes and asked exchanges to halt L-BTC deposits and withdrawals while the sidechain continues producing blocks.

The full mechanics of the exploit have not been officially confirmed, and it remains unclear whether the funds will be returned. This incident highlights how bugs in blockchain bridge and sidechain infrastructure can lead to massive, rapid losses even when systems rely on multi-signature security controls.

Key Takeaway: Australian small businesses using cryptocurrency payment rails or bridges should treat any sidechain or bridge technology as higher-risk infrastructure and pause transactions immediately if a provider reports irregular activity.