Liquid Federation loses 4000 BTC via SideSwap PAK in $320M incident

The withdrawal occurred through the SideSwap PAK on the Liquid sidechain. Federation members disabled bridge nodes and paused peg operations after detecting the movement. Exchanges halted LBTC deposits and withdrawals. Other assets including USDT and RWAs remained untouched. Blockstream stated the PAK was not breached and contacted the actors via on-chain signed messages.

Mempool.space data shows the funds moved from the federation multisig address bc1qdl. No transaction logs indicate direct key exfiltration from federation members. SideSwap integration with Liquid peg-outs created a single point that allowed the transfer despite intact keys. This pattern matches prior sidechain incidents where authorization paths were exploited rather than private keys.

The event exposes the operational risk in Liquid's 15-of-23 federation model when third-party wallet software handles peg authorizations. Exchanges and node operators now face extended downtime until the PAK usage vector is isolated. Federation members must publish a post-incident report detailing transaction signing paths before bridge reactivation.

Recovery hinges on whether the purported white-hat actors return funds following on-chain contact. Historical sidechain exploits show low recovery rates once coins reach mixer services. Liquid network activity remains frozen pending forensic confirmation.