TLDR
Self-described white-hat hackers drained nearly 4,000 BTC from Blockstreams Liquid Network and say they will return most of it after a critical bug is fixed.
- Roughly 4,000 BTC (about 320 million dollars) were withdrawn from Liquids federation wallet after exploiting a software bug in its peg-out process.
- The hackers call themselves white hats and, after on?chain negotiations, pledged to return most of the BTC, with reports that 3,400 BTC have already been sent back.
- Liquid Network remains paused, the L?BTC peg is under scrutiny, and the main thing to watch is whether full backing and user reimbursements are restored.
Deep Dive
1. What Actually Happened
Liquid Network is a Bitcoin sidechain operated by a federation, where L?BTC tokens are meant to be backed 1:1 by BTC in a reserve wallet.
On 67 September, actors described as purported white-hat hackers exploited a bug in Blockstreams Elements software that allowed creation of unbacked L?BTC, then redeemed them via SideSwaps peg?out key to withdraw about 4,000 BTC from the federation wallet, roughly 95% of reserves, worth around 320 million dollars at the time. Coverage from outlets such as CryptoPotato and The Block detail the exploit path and Liquids confirmation that keys were not directly stolen but a software flaw was abused to trigger peg?outs using fake backing.
Liquid disabled bridge nodes, paused new transactions, and exchanges suspended L?BTC deposits and withdrawals while other issued assets (like USDT) remained technically intact but hard to move on Liquid.
2. White-Hat Claims And Partial Returns
The attackers left an on?chain message reading we are whitehats. contact us on chain and began communicating with Blockstream using Bitcoin OP_RETURN messages and PGP?signed text, as reported by Galaxy Research and others.
They told Blockstream they would return most of the BTC once the bug was fixed and every node patched, a stance summarized in reports such as CryptoPotatos piece on supposed white?hat hackers planning to return funds after a fix. Later reporting from Bitcoin.com states that 3,400 BTC have been returned while around 598.5 BTC, roughly 47 million dollars, remain with the actors, with no clear agreement that this remainder is an accepted bounty.
Security experts, including Ledgers CTO, have publicly questioned whether draining nearly an entire reserve really fits standard white?hat behavior, so their white hat label remains disputed.
3. Impact On Users And What To Watch
The immediate impact is on Liquid users and the L?BTC peg. At one point, L?BTC was reportedly backed by only about 4.7% of the required BTC while funds sat in the attackers address, putting redemptions and confidence under pressure until reserves are restored.
Bitcoins base layer was not compromised, but the event reinforces that bridges and sidechains remain high?value failure points in crypto infrastructure. Going forward, key milestones are: a public technical post?mortem, rollout of patched Elements software, confirmation of full or near?full BTC backing for L?BTC, and concrete plans for user reimbursement.
For everyday users, it is another reminder to treat wrapped or bridged assets as carrying extra smart?contract and operational risk, and to keep large, long?term holdings in well?secured native Bitcoin rather than sidechains.
Conclusion
The Liquid incident shows how a single software flaw in a pegged sidechain can momentarily drain nearly all backing for a wrapped Bitcoin asset, even without private keys being stolen. Whether the self?described white hats ultimately return all or only most of the 4,000 BTC will decide how quickly trust in L?BTC recovers, and it will likely influence how future Bitcoin layer?2s and bridges are designed and audited.
CoinsKid.Com