{"id":12899,"date":"2026-09-07T09:23:13","date_gmt":"2026-09-07T09:23:13","guid":{"rendered":"https:\/\/cryptonews.uk.com\/?p=12899"},"modified":"2026-09-07T09:23:13","modified_gmt":"2026-09-07T09:23:13","slug":"a-whitehat-hacker-is-holding-320-million-in-drained-bitcoin-until-developers-prove-they-patched-a-fatal-network-flaw","status":"publish","type":"post","link":"https:\/\/cryptonews.uk.com\/?p=12899","title":{"rendered":"A whitehat hacker is holding $320 million in drained Bitcoin until developers prove they patched a fatal network flaw"},"content":{"rendered":"

<\/p>\n

\n

Liquid Network was effectively halted after nearly $320 million in Bitcoin left its federation reserve through an abnormal peg-out.<\/p>\n

The incident began Sept. 6 when a customer submitted 4,000 L-BTC to SideSwap\u2019s peg-out service, which converts Bitcoin represented on Liquid back into BTC on the main network.<\/p>\n

SideSwap said the request passed the normal authorization process and prompted the Liquid Federation to release about 3,996 BTC. The Bitcoin later moved to an address that held roughly 3,998.5 BTC at the latest check.<\/p>\n

Liquid disabled its bridge nodes after the withdrawal, while SideSwap suspended swaps, peg-ins, and peg-outs. Exchanges also paused or prepared to pause L-BTC deposits and withdrawals as operators investigated the incident.<\/p>\n

The actors controlling the Bitcoin subsequently identified themselves through on-chain messages as \u201cwhitehats\u201d and said they intended to return most of the funds once the underlying bug had been fixed across the network.<\/p>\n

\n

Related Reading<\/span><\/p>\n

Blockstream enables smart contract programmability on Bitcoin via Simplicity on Liquid Network<\/h3>\n<\/p>\n

<\/span> <\/div>\n

That prospect could limit the eventual financial loss. However, it does not resolve the more important question of how almost 4,000 BTC left the federation without an apparent key compromise.<\/p>\n

The withdrawal appears to have followed the rules<\/h2>\n

Liquid and SideSwap say the incident did not involve stolen signing credentials.<\/p>\n

The withdrawal used SideSwap\u2019s valid Peg-out Authorization Key, or PAK, and Liquid said neither that key nor other federation keys were compromised.<\/p>\n

Instead, SideSwap said Blockstream traced the 4,000 L-BTC presented for redemption to a flaw in Elements, the software underlying Liquid.<\/p>\n

If that explanation is confirmed, the problem occurred before the Bitcoin transaction was signed.<\/p>\n

Liquid is designed to maintain one BTC in its federation reserve for every L-BTC in circulation. During a normal peg-out, L-BTC is burned, and an equivalent amount of Bitcoin is released.<\/p>\n

\"Timeline\"Timeline<\/p>\n

In this case, SideSwap says a software bug created L-BTC without corresponding Bitcoin backing. Those tokens nevertheless entered a valid peg-out process, after which federation functionaries treated the withdrawal as legitimate and released real BTC.<\/p>\n