Industry News

Liquid Bitcoin Sidechain Halted After $320M Withdrawn via Software Bug

Cointelegraph · 7 Sept 2026

Key Takeaway Businesses using blockchain-based payment rails should monitor vendor security advisories closely and be ready to pause transactions if a critical vulnerability disclosure affects their provider's infrastructure.

Blockstream's Liquid, a Bitcoin sidechain used for faster transactions, was paused after unknown actors withdrew roughly 4,000 BTC (about $320 million) from its federation wallet, nearly 95% of its holdings. The withdrawal exploited a bug in Elements, the open-source software that underpins Liquid, rather than any compromise of exchange or wallet keys.

The actors, who claim to be white-hat hackers, contacted Blockstream through signed onchain messages and said they would return most of the funds once the vulnerability is patched and all network nodes are updated. They also shared encrypted technical details with Blockstream. As of writing, the Bitcoin had not been returned and the sidechain remained paused while federation members worked on a fix.

Exchange partner SideSwap confirmed the withdrawal passed through its peg-out service using an authorised key that was not itself compromised, reinforcing that the root cause was a flaw in the underlying Elements software. Other assets on the network, including stablecoins and real-world assets, were reportedly unaffected. This remains a developing situation with details still emerging.

Summarised by CISO AI from Cointelegraph. We link back to every original so you can read it yourself.