An unprecedented event shook the cryptocurrency world on Tuesday, September 8, 2026, as a group of hackers siphoned approximately $320 million worth of Bitcoin from the Liquid Network's federation wallet. What makes this incident even more remarkable is the claim by the attackers themselves to be 'white hats,' ethical hackers acting to uncover vulnerabilities, with a promise to return the funds once the issue is fixed.
Confirmation of Withdrawal and Alleged Perpetrator Identity
Liquid, a Bitcoin sidechain developed by blockchain infrastructure company Blockstream, confirmed the substantial withdrawal. In an official statement, it declared that 4,000 BTC, representing nearly 95% of the federated wallet's total balance, had been removed. The network referred to those behind the exploit as 'purported white-hat hackers,' a label echoed by the attackers who communicated their intentions via a message embedded within a Bitcoin transaction. They reportedly requested a direct audience with Liquid, stating their intent to return the money only after the security flaw is patched. 'Please fix the bug first,' the on-chain message stated. 'The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix.'
Sponsored Protocol
Security Measures and Service Impact
Liquid responded promptly to the on-chain communication, providing the contact details for its security team and moving communications to an encrypted channel. In the meantime, the platform has suspended all transactions, warning users of potential service disruptions as federation members work to restore full operation. Launched in 2018, Liquid is a federated sidechain designed to offer faster and more private Bitcoin transactions compared to the main chain. Its mechanism involves users locking BTC on the main network to receive an equivalent token, L-BTC, on Liquid, which finalizes blocks in approximately two minutes. The network is secured by a federation of over 80 exchanges and financial firms. Signatures for operations on the multisig wallet, which holds the pegged-in Bitcoin, require the consensus of 11 out of 15 rotating 'functionaries'.
Sponsored Protocol
Unusual Exploit Mechanics and Crypto Market Context
The mechanics behind the exploit are unusual. According to Liquid, the funds were withdrawn via the Peg-out Authorization Key (PAK) belonging to SideSwap, a decentralized exchange built on the sidechain. However, Liquid stated that neither this key nor any others were compromised. SideSwap corroborated the account, explaining that a customer sent 4,000 L-BTC to its peg-out service, and the system processed the order as it would any other, with the Liquid Federation disbursing 3,996 BTC to the customer's Bitcoin address. SideSwap's systems, it appears, had no way of distinguishing those coins from any other L-BTC. This incident occurs during an already challenging period for crypto infrastructure. Recently, the trading platform Drift suspended deposits and withdrawals following a suspected $270 million hack in April. In 2025, approximately $17 billion worth of Bitcoin was stolen, largely driven by impersonation schemes and AI-assisted scams. For more insights into security in digital systems, one can refer to the article on how vulnerabilities can be exploited rapidly.
Sponsored Protocol
