- A significant security compromise cost Liquid Network around 4,000 BTC, or almost $320 million.
- While Blockstream looked into the problem and informed exchangers, the network stopped functioning.
- The majority of the stolen Bitcoin was hinted at by hackers who claimed to be white hats.
- A potential Bitcoin recovery was hinted at in an on-chain communication, but it hasn’t been verified.
- The issue calls into question the security of the Liquid Network and L-BTC’s 1:1 Bitcoin backing.
Blockstream’s Liquid Network has halted operations after nearly 4,000 BTC, worth around $320 million, was withdrawn from the federation wallet backing Liquid Bitcoin (L-BTC). The incident has raised fresh concerns about the security of Bitcoin layer-2 networks and the risks surrounding digital asset bridges.
We are aware of a security incident on @Liquid_BTC. Purported white-hat hackers have withdrawn ~4,000 BTC (~$320 million) from the Liquid Federation wallet. The @Blockstream team is working on contacting them on-chain with a signed message.
What we know so far is that the funds…
— Liquid Network 🌊 (@Liquid_BTC) September 6, 2026
The attackers reportedly left a message on the blockchain. They said they were white-hat hackers. They claimed the stolen funds could be returned once the security flaw was fixed. Many people in the industry have doubts. They wonder if these attackers really deserve to be called hats.
Nearly 4,000 BTC Leaves Liquid’s Reserve
Liquid Network said the funds were withdrawn through the SideSwap PAK (Peg-out Authorization Key) and stated that the key itself was not compromised. Following the incident, the network was halted while exchanges were notified, and Blockstream began efforts to contact the attackers on-chain.
Blockchain data shows that two Bitcoin transactions removed most of the federation wallet’s reserves. A small transfer of about 2.5 BTC happened first. Then there was a bigger transaction of almost 3,996 BTC. The money was then put together into one address that had 3,998.5 BTC.
Before the problem the federation wallet was said to have, about 4,200 BTC. Its balance has now fallen to just over 200 BTC, leaving only about 5% of the previous reserve.
Other assets operating on Liquid, including USDT, DePix, and tokenized real-world assets (RWAs), have not been reported as directly affected.
Hackers Hint At Returning Most Of The Bitcoin
Does this mean they will return the BTC hacked from Liquid network?
“Sending most back to bc1qdll…wxxr, is that ok” pic.twitter.com/IxzpjItElJ
— Julio Moreno (@jjcmoreno) September 7, 2026
The situation might be heading toward a recovery. CryptoQuant analyst Julio Moreno shared an on-chain message from the address connected to the incident. The message asked, “Sending back to bc1qdll…wxxr is that ok?” This suggests the attackers could be thinking about giving back most of the Bitcoin they took from the Liquid Network.
The message does not say for sure that the funds have been sent. Blockstream and the rest of the Liquid community will still need to check any transaction. They must confirm that the returned BTC actually restores trust, in L-BTC’s backing.
Attackers Claim White-hat Intent
In an on-chain message, the attackers urged Liquid participants to patch the software before attempting to recover the funds. They claimed they would transfer the Bitcoin back after the vulnerability was fixed and verified.
That explanation has not convinced everyone.
4,000 BTC just pegged out of the Liquid bridge. The OP_RETURN says “we are whitehats. contact us on chain.”
White hats don’t drain a bridge and then solicit an “on-chain” contact. This echoes the Ronin hack, where attackers compromised validator keys to steal ~$625M, and the… pic.twitter.com/gPZmM13lXM
— Charles Guillemet (@P3b7_) September 6, 2026
Ledger CTO Charles Guillemet spoke out against the attacker’s method. He said real white-hat hackers usually share a security flaw before they take control of sums of money. In this case, the attackers acted differently by taking hundreds of millions of dollars in collateral without revealing the issue. This approach, he argued, does not match the behavior of ethical hackers. Other observers similarly said moving the Bitcoin first and discussing good intentions afterward appears more like leverage than responsible disclosure.
Former Blockstream CSO Samson Mow also questioned the legitimacy of a reported Signal contact request, saying it did not originate from the address holding the stolen Bitcoin.
The incident is unlikely to have a major immediate impact on Bitcoin’s market price, which remained near $80,000. The bigger concern is Liquid’s ecosystem and the confidence behind L-BTC’s 1:1 Bitcoin backing.
Stay informed with the latest trends in Web3, blockchain innovation, and cybersecurity updates at 3verseTV
You need to login in order to Like
Leave a comment