Liquid Network Paused After $320 Million Bitcoin Withdrawal; White-Hat Claim Follows

Blockstream's Liquid Network sidechain went dark on Sunday after an unknown party drained approximately $320 million in bitcoin from the protocol's peg, leaving an on-chain message claiming white-hat intent and triggering an immediate halt across the network.

Exchanges suspended LBTC (Liquid Bitcoin, the sidechain's native pegged asset) deposits and withdrawals as Blockstream moved to contain the situation and identify those responsible. The company confirmed it is actively attempting to contact the parties behind the withdrawal. Critically, on-chain data shows the peg still balances, meaning the ratio of locked bitcoin to circulating LBTC has not been broken. That single data point carries outsized weight right now: it is the primary reason this incident looks more like a forced vulnerability disclosure than an outright theft.

Liquid is a federated sidechain, meaning a consortium of trusted functionaries, primarily exchanges and financial institutions, collectively control the peg mechanism that locks bitcoin on the main chain and mints LBTC on the sidechain. A balanced peg after a $320 million withdrawal suggests the funds moved through the protocol's own logic rather than being conjured from thin air. If someone had exploited a minting bug to create unbacked LBTC and then redeemed it for real bitcoin, the peg would show a deficit. It does not. That narrows the likely scenario considerably.

The white-hat claim follows a pattern established in decentralized finance. Protocols including Euler Finance and Curve Finance have previously seen actors drain funds through vulnerabilities, leave on-chain messages asserting benign intent, and later negotiate returns or bounties. The on-chain note left by Sunday's actors fits that template. Whether the claim holds up depends on what Blockstream's investigation reveals about the withdrawal mechanism: was this an authorized path through the federation, an undisclosed vulnerability in the peg contract, or something else entirely? None of those answers are public yet.

What is already clear is the scale of confidence damage. $320 million represents a substantial portion of Liquid's total value locked, and a full network pause, however well-designed as a safety mechanism, signals to institutional users that the sidechain's operational continuity is not guaranteed under stress. Liquid has historically positioned itself as the Bitcoin-native infrastructure layer for exchanges, OTC desks, and asset issuers who need faster settlement and confidential transactions without moving to a separate blockchain entirely. A prolonged pause undercuts that pitch directly.

The on-chain message introduces ambiguity that cuts both ways. A genuine white-hat actor would typically coordinate privately with a protocol's security team before executing a public withdrawal of this magnitude. Draining $320 million first and leaving a note second is an aggressive approach that some security researchers defend as the only way to force a response from slow-moving organizations, but it also creates legal exposure and market disruption that a coordinated disclosure would avoid. The possibility that the message is a social engineering tactic designed to soften regulatory and legal consequences cannot be dismissed.

Blockstream has not published a post-mortem or confirmed the nature of the vulnerability. Until the company provides a technical accounting of how $320 million moved out of the peg in a single event, the market is left weighing two competing readings: a protocol that caught a critical flaw before malicious actors could exploit it, or a protocol that just demonstrated it can be drained at scale. The balanced peg is reassuring. The silence is not.