Bitcoin Layer 2 network Liquid Network reported a security incident in which alleged white hat hackers withdrew approximately 4,000 BTC, worth $320 million, from Liquid Federation’s wallet.
Blockstream attempts to contact the parties involved via a signed on-chain message.
Network bug needs to be fixed first
In an update, Liquid said the funds were withdrawn using the SideSwap PAK (Peg-out Authorization Key) but stated that the key itself was not compromised and no other keys were at risk. Crypto exchanges have been informed and have already suspended, or are preparing to suspend, LBTC deposits and withdrawals.
Liquid said other network assets, including USDT, DePix, and real-world assets, were unaffected. The network has also temporarily disabled its bridge nodes, meaning new transactions cannot be submitted. As a result, the sidechain is effectively suspended while the issue is resolved.
“Liquidity wallets will be affected and we are sorry for any inconvenience. Federation members are actively working to resolve this issue so that we can restore normal network activity.”
Public exchanges between Blockstream and the party claiming to be the white hat hacker behind the takedown continue on-chain. According to Samson Mow, the hacker seems to prefer to communicate publicly rather than by email and posts messages via Bitcoin transaction data.
They even asked Blockstream to reach out on Signal at @m671aw.70″
The exchange began at 11:30 a.m. PDT, when the hacker wrote: “we are white hats. Chain contact us.” Blockstream responded at 12:31 p.m. on September 6 and asked the hacker to contact its security team via email. Later, Blockstream sent a PGP-signed encrypted message to the hacker’s key.
The discussion between @Blockstream and the white hat hacker (WHH) regarding the ~4000 BTC of @Liquid_BTC happens in public. This seems to be their preference over email. Since it is difficult to follow the chain of messages in OP_RETURN, here is a summary with links.
11:30 a.m. PDT -… https://t.co/IEXyFpBITx
– Samson Mow (@Excellion) September 7, 2026
At 7:20 p.m., the hacker said he planned to return most of the funds and asked if a specified address was acceptable. About an hour later, they said the bug needed to be fixed first, and added:
“The chain is under threat at the last commit right now. Make sure every node is fixed. Then we will transfer the money securely after confirming the fix.”
Blockstream responded, “Yes, thank you” at 8:30 p.m. As of 9:12 p.m. PDT, approximately 3,998.5 BTC remained unchanged. There were no further messages from either side.
Unusual behavior of hackers
Charles Guillemet, CTO of Ledger, was skeptical of the white hat’s claim and pointed out that legitimate security researchers would not typically dump a deck and then request to be contacted on-chain.
He drew parallels to the Ronin hack, in which attackers stole approximately $625 million after compromising validator keys, and to the Euler exploit, where the attacker sought to negotiate the return of funds after the theft.
The move to Signal also did not change Guillemet’s view that the behavior was different from the usual activities of white hats. Despite this, the executive noted that criminal groups also generally do not reach out to their victims.
The post Allegedly White Hat Hackers Drain $320M worth of BTC from Liquid Network and Say They’ll Return It After Fix appeared first on CryptoPotato.