Liquid Network has confirmed that approximately USD 320 million was withdrawn from its federation wallet following a hack.
According to Reuters, the company stated that around 4.000 of the 4.200 bitcoin held in its Liquid Federation wallet had been withdrawn. Liquid Network described those responsible as ‘purported white-hat hackers’ and said it has halted new transactions on the network as a result.
How the withdrawal occurred
According to Liquid Network, the funds were withdrawn via SideSwap, a settlement platform authorised to process withdrawals from the network. The company clarified that the cryptographic key used in the withdrawal process was not compromised, indicating that the incident did not stem from a breach of the network's core security infrastructure. Liquid Network apologised for the disruption to users, noting that wallets on the network would be affected by the halt in transactions.
Liquid Network operates as a federated sidechain for Bitcoin, designed to enable faster settlement and increased privacy for transactions compared with the Bitcoin base layer. Federated sidechains rely on a group of functionaries, known as a federation, to manage the multi-signature wallet that secures assets moved onto the sidechain. The security of such systems therefore depends heavily on the integrity of the federation members and the keys they control.
Industry context
The incident adds to a series of security events affecting cryptocurrency infrastructure in 2026, drawing renewed attention to the risks associated with federated and multi-signature custody models used across the blockchain sector. Withdrawals executed through an authorised settlement platform rather than through a direct compromise of network keys may raise questions among industry observers about the permissions and controls governing third-party platforms with access to federation wallets.
The reference to ‘white-hat hackers’, a term generally used to describe individuals who identify security vulnerabilities without malicious intent, suggests the withdrawal may be linked to a security research or vulnerability disclosure process, though Liquid Network did not provide further detail on the identity or intentions of those involved, nor on whether the funds would be returned.
Liquid Network's decision to suspend new transactions reflects a standard precautionary measure following unauthorised or unexpected wallet activity, allowing the operator to assess the scope of the incident before resuming normal operations. As for the disclosure, Liquid Network had not provided a timeline for restoring full functionality to the network.
The event highlights ongoing scrutiny of Bitcoin sidechain security as the broader cryptocurrency industry continues to expand infrastructure built on layer-two and federated settlement models.
