Liquid discloses warm-wallet breach, suspends deposits and withdrawals

On August 19, 2021, cryptocurrency exchange Liquid disclosed that its internet-connected “warm” wallets had been compromised. The company said it was moving remaining assets into cold storage and suspending deposits and withdrawals while it investigated. That service interruption—and the scale visible in addresses Liquid identified—made the breach the date’s most consequential verified crypto development.

Liquid’s first notice established the essential facts, but not a final loss figure or an attack method. Those limits mattered: blockchain transfers can be observed, yet an address-level tally does not by itself establish which assets belonged to customers, how the intrusion occurred, or what could ultimately be frozen or recovered.

What the event-day record showed

Liquid’s official account posted the breach notice on August 19 and subsequently identified receiving addresses on the Bitcoin, Ethereum, Tron and XRP ledgers. The company also said it was tracing the assets and working with other exchanges to freeze and recover funds. These were contemporaneous company statements, not an independent forensic report.

Reuters reported at 6:52 a.m. EDT on August 19 that blockchain-analysis firm Elliptic had calculated more than $94 million received by addresses Liquid associated with the theft. Reuters gave an approximate composition of $31 million in ether, $5 million in bitcoin, $13 million in XRP and $45 million in tokens issued on Ethereum.

That $94 million was an event-day, mark-to-market estimate based on assets received at identified addresses and prevailing crypto prices. It was not an audited dollar loss, a measure of cash proceeds, or a final accounting of Liquid’s liabilities. Prices moved continuously, token liquidity varied, and the set of addresses under review could change. For those reasons, the estimate should be read as a measurement window, not false precision.

Why the compromise mattered

The incident exposed the operational trade-off behind exchange wallet design. Warm wallets remain connected enough to support routine transfers, while cold wallets are kept offline or otherwise isolated to reduce exposure. Liquid’s decision to shift assets into cold storage and stop deposits and withdrawals showed that the compromise was not merely a theoretical vulnerability; it disrupted customers’ ability to move crypto through the platform.

The response also illustrated how centralized controls and public ledgers interacted. Liquid could publish destination addresses, analytics firms could follow transactions, and exchanges or token issuers could try to block certain assets. But not every asset had an administrator capable of freezing it, and decentralized trading venues allowed swaps without a conventional exchange account. Traceability therefore did not equal recoverability.

The timing sharpened the institutional concern. Reuters noted that the Liquid breach followed the roughly $610 million Poly Network theft reported during the prior week, from which nearly all assets had reportedly been returned by August 19. The comparison was important but limited: Poly Network was a cross-chain protocol, while Liquid was a centralized exchange, and the two incidents did not establish a common attacker or technical cause.

What was still unknown on August 19

Liquid had not publicly established the intrusion vector, the identity or number of attackers, a final asset-by-asset loss, or the portion attributable to customers. It also had not completed recovery or restored normal crypto transfers. Any stronger conclusion on August 19 would have exceeded the available record.

Later context

Elliptic’s page was later updated to “just over $97 million” after additional information from Liquid. That revised figure clarifies the later record but should not replace the approximately $94 million estimate reported during the August 19 news window.