TLDRLiquid paused operations after actors withdrew about 4,000 BTC worth $320 millionThe withdrawal came from Liquid’s federation wallet, about 95% of its total holdingsActors claiming to be white hats contacted Blockstream through signed onchain messagesThey said they would return most of the funds once the Elements bug is patchedOther assets on Liquid, including USDT and real world assets, were not affectedBitcoin sidechain Liquid paused operations on Sunday after actors withdrew about 4,000 Bitcoin worth roughly $320 million from its federation wallet.Liquid said bridge nodes had been disabled, which stopped new transactions from going through. Exchanges had either halted or were preparing to halt L-BTC deposits and withdrawals.Assets issued on Liquid other than L-BTC were not affected. This includes USDT, DePix and various real world assets tracked on the network.Blockstream, the company that provides technology for Liquid, reached out to the actors using signed onchain messages. This let both sides communicate directly on the blockchain.The actors responded and said they would return most of the Bitcoin. Their condition was that the underlying vulnerability first be fixed and every node on the network install the patch.As of this report, the funds had not been sent back. Cointelegraph reached out to both Liquid Network and Blockstream for comment.The amount withdrawn made up close to 95% of the wallet’s total balance, which stood near 4,200 BTC before the incident.Liquid uses Bitcoin held in this federation wallet to back L-BTC tokens issued on the sidechain. With most of the reserve now out of the network’s control, the backing for L-BTC remains in question until a return happens.Purported White Hats Negotiate With BlockstreamJan3 CEO Samson Mow, a former Blockstream chief strategy officer, posted a timeline built from the public messages embedded in the Bitcoin transactions.According to that timeline, the actors first identified themselves as white hats at 11:30 am Pacific time. They asked for a way to make onchain contact with Blockstream.We are aware of a security incident on @Liquid_BTC. Purported white-hat hackers have withdrawn ~4,000 BTC (~$320 million) from the Liquid Federation wallet. The @Blockstream team is working on contacting them on-chain with a signed message.What we know so far is that the funds…— Liquid Network (@Liquid_BTC) September 6, 2026Blockstream replied about an hour later. It pointed the actors to its security email address and later sent a message encrypted with PGP.Hours after that exchange, the actors asked whether they could send most of the Bitcoin back to an address controlled by Blockstream.They then added a condition. The vulnerability needed to be fixed and every node updated before any transfer would happen.Blockstream answered with a short message: “Yes, thank you.” Mow said this reply addressed the question about a return address only, not the patching demand.By 9:12 pm Pacific time, about 3,998.5 BTC had still not moved. No further public messages had appeared by that point.SideSwap Says Its Systems Were Not CompromisedSideSwap, a platform that offers peg-out services on Liquid, said the withdrawal passed through its system as a customer order.It used what is called a Peg-out Authorization Key, or PAK, to process the request. SideSwap said this key itself was not compromised during the incident.The company said the L-BTC involved in the transaction came from a bug in Elements, the open source software that powers Liquid. It said the issue did not originate from SideSwap’s own systems.The post Liquid Sidechain Pauses After $320 Million Bitcoin Withdrawal appeared first on Blockonomi.