SlowMist: Liquid Network Exploit Minted 3,998 L-BTC

Blockchain security firm SlowMist has reported a Liquid Network exploit in which an attacker minted 3,998 L-BTC, a claim that lands as Blockstream confirms roughly 4,000 BTC left the Liquid Federation wallet in one of the year’s most serious Bitcoin sidechain incidents. The report puts a hard number on an event that Blockstream, the company behind Liquid, has so far described in approximate terms. And it raises the stakes for a network built to move Bitcoin faster and more privately than the main chain. For related coverage, see CrediX Recovers $4.5M in Crypto After Exploit. Here is what the evidence supports, and what still needs corroboration. SlowMist reports a Liquid Network exploit The exploit claim traces to SlowMist, a firm known for post-mortems on crypto hacks. According to unconfirmed reports carried by Crypto Briefing, SlowMist published its analysis on September 11 covering an incident dated September 6, 2026. For related coverage, see GMX Suffers $42M Exploit in Major Cyber Attack. The affected network is Liquid, a Bitcoin sidechain operated by a federation of functionaries and secured through the Elements codebase. Its native pegged asset, L-BTC, is meant to be backed one-to-one by Bitcoin held in the federation’s reserve. For related coverage, see ChangeNOW API 2026: What It Offers, Who Uses It, and Whether It Delivers. Blockstream has confirmed the broader incident. Its official notice reports that approximately 4,000 BTC, valued there at roughly $320 million, were withdrawn from the Liquid Federation wallet, according to the company’s incident permalink. Those are the issuer’s approximate figures, not independently reconciled explorer totals. Liquid Federation wallet withdrawals ≈4,000 BTC Blockstream’s initial incident notice reports approximately 4,000 BTC withdrawn from the Liquid Federation wallet. This is an official approximate withdrawal figure, not an independently reconciled loss total or the disputed L-BTC mint amount. Source: Blockstream official incident notice. Blockstream says the withdrawals used the SideSwap Peg-out Authorization Key, or PAK, while stating that this key and the other authorization keys were not compromised. In other words, the drain was not a stolen-key smash-and-grab, at least by the operator’s account. The company also said exchanges had been notified and had paused, or would pause, L-BTC deposits and withdrawals. No individual exchange notice was independently verified. Blockstream added that other Liquid assets, including USDT, DePix and tokenized real-world assets, were unaffected. The reported mint of 3,998 L-BTC The headline figure is the mint itself. According to unconfirmed reports attributed to Crypto Briefing’s readable extraction of the SlowMist analysis, the attacker minted and later redeemed L-BTC, with the report’s body citing approximately 3,998.5 units while its headline rounded to 3,998. That discrepancy matters.