Supposed White-Hat Hackers Drain $320 Million in BTC From Liquid Network, Say They’ll Return It After Fix

Bitcoin Layer 2 network Liquid Network has reported a security incident in which purported white-hat hackers withdrew approximately 4,000 BTC, worth $320 million, from the Liquid Federation wallet.

Blockstream is attempting to contact the parties involved through a signed on-chain message.

Network Bug Must Be Fixed First

In an update, Liquid said the funds were withdrawn using the SideSwap PAK (Peg-out Authorization Key) but stated that the key itself was not compromised and that no other keys were in jeopardy. Crypto exchanges have been informed and have already suspended, or are preparing to suspend, LBTC deposits and withdrawals.

Liquid said other assets on the network, including USDT, DePix and real-world assets, were not affected. The network has also temporarily disabled its bridge nodes, meaning new transactions cannot be submitted. As a result, the sidechain is effectively paused while the issue is being addressed.

“Liquid wallets will be impacted, and we’re sorry for any inconvenience. Federation members are actively working on resolving this so we can restore normal network activity.”

The public back-and-forth between Blockstream and the party claiming to be the white-hat hacker behind the withdrawal is continuing on-chain. According to Samson Mow, the hacker appears to prefer communicating publicly rather than via email, and is posting messages via Bitcoin transaction data.

They even asked Blockstream to make contact on Signal at @m671aw.70″

The exchange began at 11:30 AM PDT, when the hacker wrote, “we are whitehats. contact us on chain.” Blockstream responded at 12:31 PM on September 6 and asked the hacker to contact its security team by email. Later, Blockstream sent an encrypted, PGP-signed message to the hacker’s key.

The discussion between @Blockstream and the white-hat hacker (WHH) regarding the ~4000 BTC from @Liquid_BTC is happening in public. It seems to be their preference over email. As it’s hard to follow the chain of messages in OP_RETURN, here’s a summary with links.

11:30 AM PDT -… https://t.co/IEXyFpBITx

— Samson Mow (@Excellion) September 7, 2026

At 7:20 PM, the hacker said they planned to send most of the funds back and asked whether a specified address was acceptable. About an hour later, they said the bug needed to be fixed first, and added,

“The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix.”

Blockstream replied, “Yes, thank you,” at 8:30 PM. As of 9:12 PM PDT, around 3,998.5 BTC remained unmoved. There were no further messages from either side.

Unusual Hacker Behavior

Ledger CTO Charles Guillemet was skeptical of the white-hat claim and pointed out that legitimate security researchers would not typically drain a bridge and then ask to be contacted on-chain.

He drew parallels with the Ronin hack, in which attackers stole around $625 million after compromising validator keys, and the Euler exploit, where the attacker sought to negotiate the return of funds after the theft.

The move to Signal also did little to change Guillemet’s opinion that the behavior was unlike usual white-hat activity. Despite this, the exec noted that criminal groups do not typically reach out to their victims either.