Liquid Network, a Bitcoin sidechain used by cryptocurrency exchanges and other market participants, has halted activity after roughly 4,000 BTC worth about $320 million was withdrawn from its federation wallet.

The incident is one of the largest crypto security breaches reported this year. Liquid said the withdrawal was carried out by purported “white-hat hackers,” who later claimed they would return the funds after the vulnerability is fixed.

The network has since disabled its bridge nodes and halted new transactions while federation members investigate the incident.

Nearly 4,000 BTC Leaves Liquid

Before the incident, Liquid’s federation wallet held roughly 4,200 BTC. Around 4,000 BTC was subsequently withdrawn, representing approximately 95% of the network’s Bitcoin reserves.

The withdrawal was processed through SideSwap, a platform authorized to handle Liquid peg-outs. Importantly, Liquid said the SideSwap Peg-out Authorization Key and other keys were not compromised.

That makes the incident different from many conventional crypto hacks, where attackers obtain private keys or compromise wallets directly.

Liquid was designed to provide faster and more confidential Bitcoin settlement for exchanges and other financial participants. Bitcoin deposited into the network is represented as L-BTC, allowing transactions to settle on the sidechain rather than waiting for Bitcoin’s main network.

The loss of almost the entire BTC reserve therefore puts significant attention on the security of the system behind that settlement process.

Hackers Claim They Are White Hats

The individuals behind the withdrawal have claimed to be white-hat hackers, saying the funds will be returned once the underlying vulnerability has been fixed.

An on-chain message associated with the withdrawn funds reportedly urged Liquid to patch every affected node before attempting to recover the Bitcoin.

However, the white-hat claim has not been independently confirmed. Liquid has described the actors as “purported white-hat hackers,” and the Bitcoin has not yet been confirmed as returned.

That leaves the status of the funds uncertain while developers work to identify and fix the vulnerability.

A Different Kind of Crypto Security Breach

The incident also stands out because the available information does not point to a compromised private key.

Reports indicate that the withdrawal used a valid peg-out route through SideSwap, while the underlying issue has been linked to a vulnerability in the software used by Liquid.

Liquid has effectively paused the network while the issue is investigated. Some exchanges have also suspended or moved to suspend L-BTC deposits and withdrawals following the incident.

Other assets issued on Liquid, including USDT, DePix and real-world assets, were reported as unaffected by the security incident.

Liquid Exploit Overshadows August’s Crypto Hacks

The scale of the incident puts it into perspective against the broader crypto security environment.

Related: Crypto Hacks Skyrocket in August: 50 Cases, $136 Million Stolen

The Liquid incident alone, at roughly $320 million, is therefore more than twice August’s total reported losses.

The comparison also highlights why the Liquid exploit is significant: the attack did not target a small DeFi protocol or isolated token. It affected a Bitcoin settlement network designed to support exchange and institutional activity.

For now, the key questions are whether the vulnerability can be fully contained, whether Liquid can safely restart its network and, most importantly, whether the roughly 4,000 BTC will ultimately be returned.