Liquid Network stated that a suspected white hat hacker withdrew approximately 4,000 BTC, worth about $320 million at the time, from the federation wallet using SideSwap's Peg-out Authorization Key. The official statement claims that the key and other authorization keys were not leaked, and Blockstream is contacting the party through on-chain signed messages.

Two withdrawals are visible on-chain: one of about 2.5 BTC, followed by another of about 3,996 BTC approximately 27 minutes later, both sent to the same address. This address subsequently wrote "we are whitehats. contact us on chain" in OP_RETURN and returned dust to the federation wallet. The federation's reserves dropped from about 4,200 BTC to approximately 197 to 207 BTC, with the withdrawals accounting for about 95% of the original reserves. SideSwap reported that at 14:05 UTC, a customer transferred 4,000 L-BTC to its peg-out service, and after the usual destruction of L-BTC, the federation paid out the corresponding BTC at 14:28 UTC.

The federation wallet operates on an 11-of-15 multisig, and peg-outs are also subject to the PAK list, which requires about three days for changes. Both the official statement and SideSwap claim that the PAK was not stolen. Reports point to a minting vulnerability in the underlying Elements software: L-BTC generated out of thin air could be legitimately pegged out to main chain BTC; SideSwap stated it could not distinguish these coins from normal L-BTC. The root cause has not been fully detailed in an official technical report.

The bridge node has been shut down, and the sidechain has paused new transaction submissions, with exchanges suspending or about to suspend L-BTC deposits and withdrawals. The official statement claims that other Liquid assets such as USDT, DePix, and RWA are not affected by this withdrawal. The remaining L-BTC aligns roughly with the wallet balance, and no public liquidity gaps have been reported.

Mechanically, the buyer is the party able to construct a peg-out recognized as legitimate by the federation, while the seller is the federation holding the main chain reserves. The incident was driven by anomalies in sidechain minting or authorization paths, with funds moving from the 11-of-15 wallet to a single main chain address; the beneficiary is the claimed white hat controlling that address, while the pressured parties are L-BTC holders and exchanges that must freeze the channel. The fact that the PAK was not stolen suggests that the issue is more likely related to "what is considered valid L-BTC" rather than the keys being copied.

Public information has not confirmed the identity of the other party, refund conditions, or the final patch for the Elements vulnerability.

Source: Public information