[Update, Sept. 7, 2026, 7:30 UTC: Added correspondence between the “white hats” and Blockstream.]
Bitcoin sidechain Liquid paused operations after actors claiming to be white-hat hackers withdrew about 4,000 Bitcoin worth $320 million from its federation wallet.
On Sunday, Liquid said that bridge nodes were disabled, preventing new transactions, while exchanges had halted or were preparing to halt L-BTC deposits and withdrawals. Other assets issued on Liquid, including USDT, DePix and real-world assets, were unaffected, according to the network.
Blockstream, Liquid’s technology provider, contacted the actors through signed onchain messages. The actors said they would return most of the Bitcoin after the vulnerability was fixed and every node had installed the patch. At the time of writing, the funds had not been returned.
The withdrawal represented roughly 95% of the wallet’s approximately 4,200 BTC balance. Liquid uses Bitcoin held through its federation to back L-BTC issued on the sidechain, leaving most of the wallet’s BTC under the actors’ control until the funds are returned.
Cointelegraph reached out to Liquid Network and Blockstream for comment.
Purported white hats negotiate with Blockstream
In an X post, Jan3 CEO and former Blockstream chief strategy officer Samson Mow compiled a detailed timeline of the public messages embedded in Bitcoin transactions.
The exchange began at 11:30 am Pacific time, when the actors identified themselves as white hats and requested onchain contact. Blockstream responded about an hour later, directing them to its security email, and subsequently sent a PGP-encrypted message.
Hours later, the actors asked whether they could return most of the Bitcoin to a Blockstream address. They then demanded that the vulnerability be fixed and every node updated before transferring the funds.
Related: Satoshi-era Bitcoin wakes after 16 years of dormancy as 600 BTC moves
“Yes, thank you,” Blockstream responded.
Mow said it was answering the return-address question, not the patching condition. Around 3,998.5 BTC remained unmoved by that point, with no further messages as of 9:12 pm Pacific time.
SideSwap said the withdrawal passed through its peg-out service as a customer order using its Peg-out Authorization Key (PAK), but that the key was not compromised. It said the L-BTC used in the transaction originated from a bug in Elements, the open-source software underpinning Liquid, rather than SideSwap’s systems.
Magazine: ‘White hats’ take 4000 BTC from Liquid, ETFs see best inflows of 2026: Hodler’s Digest
