SideSwap has stopped its Liquid-related services after a customer sent 4,000 L-BTC to its peg-out service. The transaction was later linked to an Elements software vulnerability. The order was processed normally, with the L-BTC burned on the Liquid network and a valid peg-out authorization recorded. The Liquid Federation gave 3,996 BTC to the customer’s Bitcoin address.
Blockstream confirmed that the L-BTC had been minted through the vulnerability. SideSwap said its authorization key and systems were not compromised, while emphasizing that it could not distinguish the affected tokens from other L-BTC tokens.
What Happened to the 4,000 L-BTC Sent to SideSwap?
SideSwap stated that the customer sent 4,000 L-BTC to its specs service at 14:05 UTC and the transaction was deemed normal. According to Chaincatcher, the L-BTC was burned on Liquid with a valid payout authorization. At 14:28 UTC, the Liquid Federation paid 3,996 BTC to the customer’s Bitcoin address. Blockstream later confirmed that the L-BTC had been minted through an Element software vulnerability. SideSwap said that this issue did not involve compromising the payout authorization key or its systems. The service also said it had no way to bifurcate the affected L-BTC from other legitimate L-BTC.
The organization noted that SideSwap operates as a non-custodial service, meaning users’ wallets are not affected and assets remain under their control via their own keys. The distinction between the software vulnerability and the authorization system is key to the incident. Liquid and SideSwap said the relevant authorization key itself was not compromised. Instead, the issue appears to have involved L-BTC that was created through the Element vulnerability and then accepted by the normal payout process. This means that the transaction could be deemed valid to SideSwap even though the online tokens were not authorized.
We are aware of a security incident on @Liquid_BTC. Purported white-hat hackers have withdrawn ~4,000 BTC (~$320 million) from the Liquid Federation wallet. The @Blockstream team is working on contacting them on-chain with a signed message.
What we know so far is that the funds…
— Liquid Network 🌊 (@Liquid_BTC) September 6, 2026
Liquid’s payout process typically converts L-BTC back into Bitcoin by burning it on the sidechain and releasing BTC from the federation’s Bitcoin wallet. SideSwap’s own information states that a payout trigger requires confirmation on Liquid before BTC is released to the appropriate Bitcoin address. The scale of the withdrawal also differs from that of a routine payout. Reports say the Federation wallet held roughly 4,200 BTC before the incident, meaning the 3,996 BTC payment consumed most of the reserve backing L-BTC.
Why Has Liquid Been Suspended and What Happens Next?
Following the incident, Liquid Federation suspended the network. SideSwap said the swap, peg-in, and peg-outs will remain halted until the network is restored. Payouts already made in Bitcoin are not affected by the suspension. However, users with incomplete peg-in or peg-out transactions have been asked to send their transaction IDs so they can be managed separately.
SideSwap also advised users not to send new peg-in and peg-out deposits until the services are resumed. The pause is expected to remain in place while the network issue is being dealt with and Liquid services are restored. Liquid also disabled its bridge nodes following the issue, while exchanges were asked to suspend L-BTC deposits and withdrawals as a precautionary measure. The Bitcoin-based network itself was not compromised; the incident occurred within the Liquid sidechain and its associated software elements.
The incident has therefore left Liquid facing two immediate priorities: recognizing and fixing the element’s vulnerability and understanding what happens to the withdrawn Bitcoin. Until the underlying issue is addressed, peg-in and peg-out activity cannot return to normal. For Side Swap users, the immediate guidance remains to not send new deposits and to contact the platform with transaction IDs if they have an unfinished transaction. The organization has also clarified that the full Bitcoin payouts remain unaffected.
