Every week we pick one withdrawal-related story and go deep. This week the choice was easy, because two separate platforms ended the week with the same four words — deposits and withdrawals paused — and a third was drained outright. A Bitcoin sidechain lost 95% of its reserve and halted. A perpetuals platform lost $287,000 to a self-trade and paused. A DeFi insurance protocol was drained for the second time in thirteen months — and, notably, never paused at all.
What makes these worth a report together is not the loss total — it is the response. In each case the mechanism was different, the amount was different, and the response ranged from a total chain halt to no pause whatsoever. That spread is the point: whether your money is frozen or gone depends entirely on which platform held it. This report covers how each one happened, what a pause actually costs compared with a theft, why this is the second consecutive week with a chain- or platform-level halt, and the checklist that follows from it.
Between September 5 and September 7, two platforms froze withdrawals outright and a third was drained. Blockstream halted the Liquid Network after attackers minted unbacked L-BTC through an Elements validation bug and pegged out 3,996 BTC (~$320 million), leaving roughly 200 of 4,200 reserve BTC. Rocket paused all deposits, withdrawals and trading after a dormant perp market was manipulated for ~$287,000. Cozy Finance lost ~$170,000 on Optimism in the early hours of September 7 — its second exploit on that chain since August 2025, and hours outside the weekly window we track. Meanwhile the rails themselves were fine: exchange fees held flat for a third week, TRON posted record Q2 numbers, and both USDT and USDC stayed on peg. The lesson is structural: your withdrawal risk is concentrated in the platform you chose, not the network you send over.
🧩1. The Three Incidents, Side by Side
| Platform | Date (2026) | Loss | What Was Paused | Mechanism |
|---|---|---|---|---|
| Liquid Network | Sep 6–7 | ~3,996 BTC (~$320M) | L-BTC deposits and withdrawals; bridge nodes disabled | Elements validation bug → unbacked L-BTC minted → whitelisted peg-out |
| Rocket | Sep 5, paused Sep 6–7 | ~$287,000 | Deposits, withdrawals and trading | Dormant perp market manipulated with inflated self-trades |
| Cozy Finance | Sep 7 | ~$170,000 | Optimism deployment emptied (no formal pause) | Second exploit on the same chain; funds bridged out in 13 minutes |
🛡 FE0F2. Liquid: every safeguard worked, and the money left anyway
The most instructive detail of the week is that no key was compromised. Liquid's peg wallet is guarded by an 11-of-15 multisig of vetted functionaries, plus a second lock, the Peg-out Authorization Key, designed to stop any single compromised member from moving funds. Both layers functioned. At 14:05 UTC on September 6, a peg-out request for roughly 4,000 L-BTC arrived through SideSwap's whitelisted authorization key. At 14:28 UTC, a single consolidated Bitcoin transaction paid out 3,996 BTC — the balance being SideSwap's 0.1% service fee, with a small ~2.5 BTC test peg-out having gone out about 27 minutes earlier. Eleven or more hardware modules signed a transaction their own software reported as fully valid.
The failure was one level down: a validation flaw in Elements, the open-source software running the sidechain, let the attackers mint L-BTC that no Bitcoin backed. That fabricated L-BTC entered an authorized peg-out service as a routine customer order, and the system did what a peg-out is built to do — burn the incoming token and release real Bitcoin from the reserve. The wallet went from about 4,200 BTC to roughly 200 BTC. Blockstream disabled the bridge nodes within hours; USDT and tokenized real-world assets on the network were unaffected, and Bitcoin mainnet was never at risk. The attackers then posted an OP_RETURN message claiming white-hat status and conditioning any return on Blockstream shipping a patch and getting every node updated, and Blockstream replied in the same channel with a signed message pointing to its security team.
Takeaway: Multisig and authorization keys protect against a compromised signer. They do not protect against a compromised view of the ledger — and when that fails, the only remedy available is to stop everyone's withdrawals.
📉3. Rocket and Cozy: small losses, diverging responses
Rocket lost about $287,000 — a rounding error next to Liquid — but the mechanism is worth understanding because it is not a smart-contract bug at all. At roughly 19:00 UTC on September 5, an attacker used a burner account to post inflated orders in a dormant perpetual market and traded against itself, manufacturing fake profits in one account while pushing the burner into bankruptcy. The profitable account then withdrew around $287,000 through the Bridge, socializing the loss across the platform. Rocket paused deposits, withdrawals and trading, and is coordinating with exchanges, bridges and stablecoin issuers to trace and freeze the funds, with smaller accounts first in line for refunds.
Cozy Finance is the repeat case, and repeats are the signal. On September 7 at 05:43 UTC, about 163,326 USDC.e moved out of its Optimism deployment across 63 transfers, and the funds were bridged at 05:56 UTC — thirteen minutes later. The attack contract had been deployed five days earlier, on September 2. In August 2025 the same protocol lost roughly $427,000 on Optimism through a flaw in withdrawal code that never verified who completed a redemption. Two losses, one chain, one recurring theme.
Takeaway: Loss size and user impact are barely correlated. A $287,000 incident produced a total platform pause; a $320 million one produced a total chain halt. What users experience — no access — is the same.
💸4. What a Pause Actually Costs, Compared With the Theft
For most users the theft is not the cost — the freeze is. A stolen amount is usually absorbed by the protocol, its insurers, or a socialized-loss mechanism; what lands on you is the period in which your balance is real but unreachable. That cost has three parts: opportunity cost (you cannot rebalance or exit during the move you wanted to make), settlement risk (a payment you owed is now late), and resolution risk (refund priority, haircuts and timelines you do not control — Rocket has already said smaller accounts go first, without publishing a timetable).
Set that against the costs we track every week and the proportion is almost comical. Choosing Kraken (2.5 USDT) over a $1-floor venue costs $78 a year at weekly frequency. A single week of frozen access on a meaningful balance costs more than a decade of that difference. The fee you can optimize is the smallest number in the system.
Takeaway: Optimize the fee because it is free to do — but rank your risks by exposure, not by headline. Platform selection dominates every basis point you will ever save.
👀5. The Pattern: Second Straight Week With a Halt
- Week of Aug 24–30: Tectonic exploited for ~$74 million on Cronos, and Cronos halted the entire chain to contain it — freezing withdrawals for every user on it, not just the victim protocol's.
- Week of Aug 31–Sep 6: Liquid Network halted (~$320M), Rocket paused (~$287K), Cozy drained (~$170K), plus Notional (~$1.73M) and Full Sail (~$91K).
- The common thread is that a chain-level or platform-level halt is the standard containment tool, and it is indiscriminate. Choosing a different protocol on the same chain does not diversify this risk away.
- The rails underneath — TRC20, BEP20, Solana, ERC20 — had zero incidents this week. Exchange withdrawal fees did not move for a third week and both major stablecoins held their pegs.
✅6. The Withdrawal-Risk Checklist That Follows
- Separate rails from platforms: keep operating balances on the rail you send over, and treat anything held inside a protocol as a position, not a balance.
- Ask what the containment tool is before you deposit: if the honest answer is "we would halt," your withdrawal is contingent on someone else's incident response.
- Treat repeat incidents as disqualifying: Cozy's second Optimism loss in thirteen months is the clearest signal available, and it was visible before the second one.
- Watch thin markets: Rocket's loss came from a dormant perpetual with no real liquidity — the same shape as the Tectonic and Moonwell collateral attacks in August.
- Keep your withdrawal path short: fewer hops between the venue and your wallet means fewer platforms whose incident response you depend on.
The rails were flawless — 1 USDT from OKX over TRC20, ~1.7 TRX with rented energy, stablecoins on peg — while two platforms above them pressed pause and a third was drained; the fee is the one number you control, and it is the one that matters least.