Liquid Network just lost almost its entire $BTC reserve in a single Sunday incident. On September 6, ~4,000 BTC left the Liquid Federation wallet, worth ~$320 million. The reserve went from ~4,200 BTC to just over 200 BTC, meaning ~95% of the reserve suddenly left. Then things got weird. This does not currently look like someone simply stole the federation keys. Liquid says the withdrawal went through the SideSwap Peg-out  Authorization Key, or PAK, and that the key itself was not compromised.  The other authorization keys were also reportedly unaffected. The exact vulnerability has not been publicly explained. What we do know is that ~3,996 BTC was processed through a peg-out, with the corresponding $LBTC burned. That distinction matters because the LBTC supply was reduced alongside the withdrawal. Meanwhile, $USDT, DePix and the real-world assets issued on Liquid were reportedly unaffected. Then the person who moved the Bitcoin left a message on-chain: “we are whitehats. contact us on chain.” White hats? Maybe. But that is still only a claim. Ledger CTO Charles Guillemet has questioned whether the behavior fits a traditional white-hat disclosure, noting that legitimate security researchers would normally disclose the vulnerability before moving hundreds of millions of dollars. Liquid's model is simple: BTC is locked on Bitcoin while LBTC is issued on Liquid. During a normal peg-out, LBTC is burned and the corresponding BTC is released from the federation's reserves. That is what makes this incident so unusual. The peg-out happened, the LBTC was burned, and the BTC left the federation reserve, yet Liquid says the PAK itself was not compromised. So the mechanism that allowed this transaction to happen remains unexplained. Until the full mechanics are disclosed, calling this a “white-hat rescue” is premature. The funds have not been confirmed returned, and the people controlling them have not been independently identified as white hats. This matters beyond Liquid. For years, Liquid offered a different model for moving Bitcoin: BTC with a federation, an 11-of-15 multisig and a controlled bridge designed to provide additional security around a Bitcoin sidechain. On September 6, those security assumptions faced a brutal stress test. Bitcoin itself wasn't hacked. The Bitcoin network kept running. The incident happened around the mechanism connecting BTC on Bitcoin with LBTC on Liquid. And that distinction is everything. The $320 million is the headline. The real story is how ~95% of the federation's reserve was able to leave through a valid-looking peg-out while Liquid says the authorization keys themselves were not compromised. Until that is fully explained, this isn't just another crypto hack. It's a massive test of the security assumptions behind one of Bitcoin's largest federated sidechains.