Quick answer: Liquid Network reported that roughly 4,000 BTC were withdrawn from its federation wallet in a major September 2026 security incident. The network halted new transactions as a precaution. If you use Liquid or L-BTC, avoid initiating new transfers until your wallet, exchange and Liquid's official channels confirm normal operation.

What happened to Liquid Network?

Liquid is a federated Bitcoin sidechain used for faster asset transfers and settlement. Reuters reported on September 7 that Liquid said around 4,000 of approximately 4,200 BTC held in its federation wallet had been withdrawn by actors described as purported white-hat hackers.

Liquid said the withdrawals were conducted through SideSwap and that the cryptographic key involved had not been compromised. The investigation and recovery process make this a high-impact infrastructure incident rather than a routine wallet outage.

What should Liquid users do now?

Do not initiate a new Liquid transfer while your service provider reports transactions as paused.
Check official Liquid and the specific exchange or wallet you use for restoration status.
Preserve transaction IDs for any transfer submitted before the halt.
Do not import your wallet seed into any “incident recovery” website.

How to check a pending Liquid transaction

First determine whether your wallet or exchange created a transaction ID. If no transaction was broadcast, the request may still be held by the sending service. If a transaction exists, inspect its on-chain status with a reputable Liquid explorer.

A network-level pause can mean that even a correctly constructed transfer does not progress normally. Avoid repeatedly resending funds while infrastructure is intentionally halted.

What if your L-BTC is on an exchange?

Check that exchange's deposit and withdrawal status separately. An exchange can suspend Liquid deposits or withdrawals even if other parts of its platform remain available. Trading balances inside a custodian are not the same as an on-chain withdrawal.

What if your L-BTC is self-custodied?

Keep control of your keys and wait for authoritative network guidance. Do not move keys into unfamiliar software because someone claims a special migration or rescue transaction is required.

Beware of recovery scams

Large hacks generate impersonation campaigns. Attackers may pose as Blockstream, Liquid, SideSwap or exchange support and ask users to connect wallets, sign arbitrary transactions or disclose recovery phrases. None of those actions should be necessary merely to receive a status update.

Why the federation wallet matters

Liquid's design uses a federation to operate the sidechain and manage its Bitcoin peg. A major incident involving federation-held Bitcoin therefore has implications beyond a single user's wallet. Users should distinguish between their local wallet security and broader network/peg infrastructure risk.

What sources should users follow?

Prioritize official Liquid/Blockstream incident communications and the status pages of the exchange or wallet you actually use. Reuters independently reported the incident and the approximate amount withdrawn. Avoid treating social-media screenshots as recovery instructions.

FAQ

Was a user's seed phrase leak responsible?

The public incident reporting concerns federation infrastructure, not a general disclosure of ordinary users' seed phrases.

Should I send L-BTC to someone who says they can recover it?

No. Do not send assets or keys to unsolicited recovery services.

Can an exchange balance still appear during a network halt?

Yes. Internal account balances and trading can be separate from on-chain deposit and withdrawal availability.

When should I transact again?

Only after the network and the specific service you use confirm that transfers are operational.

This article is for technical and security information only and is not investment advice.

Liquid Network Hack: What Bitcoin Sidechain Users Should Do