Blockstream's Liquid Sidechain Flags 'Anomalous' 4,000 BTC Movement Valued Around $320M

CoinDesk reports that Blockstream's Bitcoin sidechain Liquid has been effectively suspended since Sunday, with bridge nodes shut down after an incident involving roughly 4,000 BTC. Based on the price referenced in the report, the amount is valued at about $320 million. The outflow came from the federation wallet that backs circulating LBTC (Liquid Bitcoin). Liquid and federation member SideSwap said a customer sent 4,000 LBTC to SideSwap at 14:05 UTC. The tokens were then burned with valid authorization, and about 23 minutes later the federation wallet paid out approximately 3,996 BTC via the standard redemption (peg-out) process. Liquid said the funds exited through SideSwap's peg-out authorization key, adding that neither that key nor any other federation keys were compromised. SideSwap likewise said its systems were not breached and pointed to a vulnerability in Elements, the software underpinning Liquid. Blockstream has not publicly disclosed the specific flaw, though Liquid's underlying software reportedly received a relevant fix about five weeks ago. Based on details disclosed so far, the report says no bitcoin was forcibly taken from wallets. Instead, LBTC lacking full bitcoin backing was allegedly created and then redeemed for BTC through what appeared to be a legitimate process. The federation wallet balance has fallen to about 200 BTC from roughly 4,200 BTC before the event, leaving around 5% of the prior level. Key figures disclosed: - Abnormal outflow: ~4,000 BTC - Post-incident federation wallet balance: ~200 BTC - Settlement time difference: ~23 minutes A timeline shared by Samson Mow, Blockstream's former head of security, indicates the address involved currently holds about 3,998.5 BTC. On-chain message claims "white hat" The party that initiated the transfers left an on-chain message stating, "We are white hats; please contact us onchain." Blockstream reportedly replied via the email address posted on-chain, and the two sides allegedly continued communicating using PGP-signed messages embedded in Bitcoin transactions. Ledger CTO Charles Guillemet questioned the "white hat" characterization, arguing that legitimate white hats would not drain bridge funds first and then request on-chain contact. He also said some self-described white hats have recently refused to return funds until vulnerabilities are patched. Other Liquid assets not affected Information released so far suggests other assets on Liquid, including USDT, DePix and tokenized real-world assets, were not impacted. The Bitcoin mainnet is also unaffected, indicating the disruption is concentrated in Liquid's bridging and asset-mapping mechanisms rather than the Bitcoin network itself.