Liquid pauses after roughly 4,000 BTC leaves its federation wallet

The transfer followed a peg-out transaction that moved bitcoin from Liquid's reserve structure toward the Bitcoin mainchain. Onchain messages referred to “whitehats,” but that label is a claim by an unidentified actor, not proof that the funds were recovered or that the withdrawal was authorized.

The key distinction is a security response is not a resolution. Pausing deposits, withdrawals or related services can limit further damage, but it does not establish the exploit path, identify the actor or guarantee that Liquid users will be made whole.

Liquid’s federation is the critical trust layer

Liquid is a Bitcoin sidechain that uses a federation to hold bitcoin backing for L-BTC. That design can support faster settlement and additional functionality, but it concentrates operational responsibility in the wallet controls, signing process and participating federation members.

Bitcoin Magazine and other independent reports described the reserve falling sharply after the transfer. The figures are based on public blockchain activity and network statements; the final loss amount, vulnerability and recovery status remain subject to investigation.

Users should watch the signed incident report and reserve reconciliation. The useful follow-up evidence includes the affected transaction IDs, the software or key-control failure, the status of L-BTC redemptions, any returned funds and the safeguards added before the network resumes normal operations.

The incident does not compromise Bitcoin's base layer. It does, however, illustrate the trade-off in federated bridges and sidechains: users gain a service layer while relying on a smaller group of entities to secure the reserves. Until the investigation is complete, “white hat” should be treated as an unverified description rather than a finding.