Around 4,000 BTC — roughly $320 million at current prices — was withdrawn from the federation wallet that backs the Liquid Network, leaving the project scrambling and the people behind the transfer insisting they are "whitehats."
The withdrawal: 4,000 BTC removed from Liquid's federation wallet
Liquid, the Bitcoin sidechain developed by Blockstream and used by exchanges and financial firms, said in a post on X on Sunday that approximately 4,000 BTC had been taken from its federation wallet. The wallet held about 4,200 BTC before the incident, meaning the withdrawal removed roughly 95% of the federation's holdings. Liquid characterized the actors as "purported white-hat hackers" while the federation membership investigates the exploit.
On-chain conversation: claims, reassurance, and a promise to return funds
The people who moved the coins left a message embedded in a Bitcoin transaction identifying themselves as "whitehats" and asking Blockstream to make contact. Blockstream replied on-chain with contact details for its security team, and Liquid said the two sides subsequently shifted communications to encrypted channels. In the embedded message the actors wrote, "Please fix the bug first. The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix." They also told Blockstream they would return "most" of the Bitcoin once the vulnerability was addressed and Liquid's nodes had been updated.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleTechnical vector: SideSwap peg-out and the mystery of the PAK
Liquid said the BTC was withdrawn through SideSwap using its Peg-out Authorization Key, or PAK. PAKs allow federation functionaries to recognize destinations authorized to receive peg-outs; the functionaries collectively release the corresponding Bitcoin. Liquid reported, however, that neither SideSwap's key nor any other PAK appeared to have been compromised. How an apparently authorized SideSwap peg-out was able to empty nearly the entire federation wallet without a compromised PAK remains under investigation.
Liquid's operational response and immediate containment
As a containment measure Liquid disabled its bridge nodes and asked exchanges to suspend L-BTC deposits and withdrawals while federation members investigate. Other assets issued on Liquid, including stablecoins, do not appear to have been directly affected, and the Bitcoin network itself—separate from Liquid—was untouched. Liquid emphasized the distinction between Liquid's federated security model and the Bitcoin network's mining-based security: it described Liquid as a federation whose members collectively manage the Bitcoin backing L-BTC rather than relying on Bitcoin's miners to secure those funds.
What this means for Blockstream, exchanges, and Liquid users
- Blockstream: The company has been contacted on-chain and provided security team details in return; its immediate task is coordinating the patching and verification steps the actors requested and helping the federation determine how the peg-out was authorized.
- Exchanges and custodians using Liquid: They have been asked to suspend L-BTC deposits and withdrawals and will be watching federation guidance about node patches and re-enabling of bridge services before resuming operations.
- Liquid users and holders of L-BTC: Their Bitcoin-backed positions were the direct target; other Liquid-issued assets such as stablecoins did not appear directly affected, but users face uncertainty while the federation validates fixes and recovers (or not) the withdrawn BTC.
The episode underlines a concrete technical and governance question central to federated sidechains: who or what must be trusted to authorize large peg-outs, and how that authorization can be validated after it happens. Those questions are not merely academic in this case—the answer will shape whether the actors' "whitehat" claim is seen as a legitimate security intervention or an exploit that removed most of the federation's backing assets. Liquid and its federation members are left to reconcile the immediate operational imperative of patching nodes with the longer, more delicate task of recovering funds and restoring market confidence.
Original reporting: Hackers drain $320M in Bitcoin from Liquid Network, claim they're the good guys — The Register
