TLDR
Alleged white-hat hackers who drained nearly 4,000 BTC from Bitcoin sidechain Liquid say they will return most of the funds after a critical bug is fixed.
- Purported white hats withdrew about 4,000 BTC, roughly 95% of Liquids pegged reserves, and the sidechain is paused while exchanges halt L-BTC deposits.
- The hackers have pledged on-chain to return most of the BTC only after Blockstream patches every node, but experts dispute whether this is genuine white-hat behavior.
- Bitcoin mainnet is not affected, but Liquid users face frozen functionality and must watch whether the bug is fixed and the BTC actually flows back.
Deep Dive
1. What Happened On Liquid
Reports indicate that actors claiming to be white-hat hackers withdrew about 4,000 Bitcoin (around 320 million dollars) from the Liquid Network federation wallet, around 95% of its roughly 4,200 BTC balance.
The funds were moved from the sidechains peg wallet to a single Bitcoin address, accompanied by an OP_RETURN message stating we are whitehats. contact us on chain. Liquid disabled bridge nodes, effectively pausing the sidechain, and major venues have halted L-BTC deposits and withdrawals.
Liquid says the withdrawal used SideSwaps Peg-out Authorization Key, but current reporting attributes the root issue to a bug in Blockstreams Elements software rather than a compromised key.
2. White-Hat Pledge And Doubts
In subsequent on-chain exchanges, the hackers pledged to return most of the nearly 4,000 BTC after Blockstream fixes the vulnerability and patches every node, stressing that the chain remains at risk at the latest software commit.
As of the latest updates, almost all of the BTC still sits under the attackers control, so the pledge is not yet fulfilled. Liquid itself only calls them purported white hats, and Ledgers CTO has questioned the white-hat label, comparing the situation to past bridge hacks.
There is a path where losses are largely reversed, but until funds actually move back to the federation address, users should treat this as an unresolved exploit, not a completed rescue.
3. User Impact And What To Watch
Liquid users holding L-BTC or other assets on the sidechain are impacted by paused bridge nodes and exchange suspensions, even though reports say USDT and other issued assets on Liquid were not directly drained.
Bitcoin on the main chain is not technically compromised, but confidence in federated sidechains and bridge-style pegs takes another hit, since one bug at the node or protocol level exposed almost all reserves.
Key next signals to watch are: a detailed technical postmortem from Blockstream, confirmation that nodes are patched and Liquid is safely restarted, and on-chain evidence that a substantial share of the BTC actually returns to the federation wallet.
Conclusion
A single software vulnerability on Liquid allowed actors to drain nearly all pegged BTC, and their conditional promise to return most of it highlights how much trust and coordination these systems require. Until the bug is fully disclosed, nodes are patched, and the BTC moves back, the episode remains both a live security incident and a cautionary example of the systemic risk in Bitcoin sidechains and bridges.
CoinsKid.Com