Liquid Network Halts Processing After Claimed $320M BTC "Whitehat" Withdrawal

Liquid Network has paused operations following a reported $320 million Bitcoin withdrawal from multisig reserve addresses. The entity behind the transaction says it was a whitehat rescue prompted by a suspected security flaw. The scope is the critical point: Bitcoin mainnet did not stop. Blocks continued to be produced normally, and standard BTC transfers were not disrupted. The disruption is limited to Liquid, Blockstream's Bitcoin sidechain, where operators halted transaction processing while engineers assess the event. Liquid is a separate network designed for faster settlement, confidential transactions, and asset issuance used by exchanges, traders, and institutions. Bitcoin locked into Liquid is managed via a federated model rather than Bitcoin's native proof-of-work finality. That structure makes any suspected multisig issue, and any large movement from reserve addresses, an event operators must treat as high risk. The "whitehat" claim remains unverified. In crypto, funds can be moved in ways presented as protective before a coordinated disclosure process is completed, and public statements do not substitute for confirmation. At this stage, it is premature to describe the funds as definitively stolen absent confirmation from Liquid operators. It is also premature to characterize the incident as harmless until reviews and audits are complete. For Liquid users, the pause is consequential. Sidechains rely on confidence in their bridge mechanics, operator set, and security assumptions. A halt interrupts normal settlement and may force exchanges, issuers, wallet providers, and traders to wait for clarity before moving assets or relying on the network. Next steps are expected from Liquid or Blockstream in the form of a timeline and incident report addressing what triggered the withdrawal, whether the whitehat claim is accepted, whether any funds were at risk, what vulnerability was suspected, and when normal operations can resume. Until then, markets should treat this as an active sidechain security incident with limited confirmed facts. The key takeaway remains that this was not a Bitcoin base-layer outage. It is a Liquid-specific operational and security event that may raise broader questions about sidechain design, multisig security, and federation governance. This report draws on Liquid Network's official status update and publicly available materials related to the incident. The report is based on information posted on X.