The Liquid Network security incident remains one of the most important infrastructure breaches of 2026.
Attackers withdrew roughly 4,000 BTC from the Bitcoin sidechain’s federation wallet. At the time of the incident, the assets were worth approximately $320 million and represented most of the wallet’s Bitcoin.
Liquid said the withdrawals moved through infrastructure associated with SideSwap, an authorized settlement participant. The network also reported that the relevant cryptographic key had not been compromised, pointing investigators toward a deeper authorization or validation failure.
The attackers described themselves as white hats and communicated through blockchain transactions. After a patch was issued, approximately 3,400 BTC was reportedly returned.
That still leaves roughly 600 BTC unresolved, subject to final reconciliation and confirmation. The network’s pause and recovery process also demonstrate the operational consequences of security failures in federated systems.
The incident is particularly significant because Liquid is built around trusted functionaries rather than Bitcoin’s fully permissionless mining model. The exploit therefore tests the governance and incident-response assumptions behind federated sidechains.
TOKEN RECON ASSESSMENT
Returning most of the Bitcoin reduces the immediate financial loss, but it does not erase the breach. The critical intelligence is how unauthorized withdrawals passed through the system without a reported key compromise.
Watch the final technical postmortem, the disposition of the remaining BTC, independent audits and the conditions required before unrestricted network activity resumes.
Sources: Reuters initial incident report, TRM Labs analysis, Technology report on the recovery
