[Update, Sept. 7, 2026, 7:30 UTC: Added correspondence between the “white hats” and Blockstream.]
Bitcoin sidechain Liquid has halted its operations following the withdrawal of about 4,000 Bitcoins worth $320 Million from its Federation wallet by actors who claimed to be white-hat hacker.
On Sunday, Liquid said Exchanges have halted L-BTC withdrawals and deposits or are preparing to do so. The network reported that other assets issued by Liquid including USDT and DePix as well as real-world assets had not been affected.
Blockstream – Liquid’s tech provider – contacted actors by sending them signed onchain message. The actors said After the vulnerability is fixed, and all the nodes have installed the patch, they will return the bulk of the Bitcoin. The funds have not yet been refunded as of the date this article was written.
The withdrawal made up approximately 95% of the wallet’s 4,200 BTC. Liquid utilizes Bitcoin in its federation for the L-BTCs issued on the Sidechain. The majority of BTC from the wallet is under the control of the actors, until they return the funds.
Cointelegraph contacted Liquid Network for a comment and Blockstream to provide a response.
Blockstream negotiates with purported white hats
Samson Mow, former Blockstream Chief Strategy Officer and Jan3 CEO, has posted an X-post. compiled A detailed time line of public messages that are embedded within Bitcoin transactions.
The exchange started at 11:15 am Pacific time when the white hats identified themselves and asked for onchain contact. Blockstream replied about an hour after the exchange began, by directing users to their security email and sending a PGP encrypted message.
The actors then asked if they could send the majority of Bitcoins to an address on Blockstream. The actors demanded the fix of the vulnerability and an update to every node before they would transfer the funds.
Related: Satoshi-era Bitcoin wakes after 16 years of dormancy as 600 BTC moves
“Yes, thank you,” Blockstream response.
Mow replied that the answer was to return-address, not patching conditions. By that time, around 3,998.5 BTC was still unmoved. There were no more messages at 9:12pm Pacific Time.
SideSwap said The withdrawal was processed through the Peg Out Authorization Key, but the key had not been compromised. SideSwap said that the L-BTC in this transaction was a result of a bug within Elements (the open-source software behind Liquid), and not in its systems.
Magazine: ‘White hats’ take 4000 BTC from Liquid, ETFs see best inflows of 2026: Hodler’s Digest
“This article is not financial advice.”
“Always do your own research before making any type of investment.”
“ItsDailyCrypto is not responsible for any activities you perform outside ItsDailyCrypto.”
Source: cointelegraph.com
