White‑Hat Hackers Withdraw 4,000 BTC from Blockstream's Liquid Network Reserves

Event Summary

The Liquid Network announced on Sunday that a group calling itself white‑hat hackers moved roughly 4,000 bitcoin (about $320 million) from the federation wallet that backs the L‑BTC token. The breach caused bridge nodes to be disabled and the sidechain to be paused, though other assets such as USDT and DePix were not affected.

Key points

• Approximately 4,019.4 BTC were withdrawn in a single peg‑out transaction.
• The treasury held over 4,200 BTC before the incident and just over 207 BTC after, according to Blockstream’s proof‑of‑reserves page.
• Bridge nodes were paused; L‑BTC deposits and withdrawals were halted on exchanges.
• The funds were sent to an address ending in 6gyqjlte, where the hackers posted an OP_RETURN message claiming to be white‑hats.
• SideSwap, a bridge exchange and Liquid Federation member, was used for the peg‑out authorization.

Official statement

The Liquid Network posted on its X account that the white‑hat hackers withdrew about 4,000 BTC from the federation wallet. It confirmed that bridge nodes were disabled and the sidechain was paused, while other issued assets remained unaffected.

Details of the breach

The withdrawal used transaction hash 8db751a650ae2f12006b7e8c69a75e4df360e8afd6b9e05ae0b9fa6458a7b140. The hackers moved the coins to the address bc1ql4mfu6aundtkksxklfajs2h3t9nzcd6gyqjlte and added an OP_RETURN field saying “we are whitehats. contact us on chain.” A later small mainnet transaction from that address included an OP_RETURN message asking to contact [email protected], but this was not confirmed to be from Blockstream.

What is confirmed

• The Liquid Network’s X post confirming the withdrawal and the pause of bridge nodes.
• The amount withdrawn (about 4,019.4 BTC) and the transaction hash.
• The use of SideSwap’s peg‑out authorization key.
• The current balance of the federation treasury (just over 207 BTC) as shown on Blockstream’s proof‑of‑reserves page.

Unclear aspects

• The exact technical mechanism of the hack has not been verified; reports suggest an inflation bug on the LBTC sidechain, but this remains unconfirmed.
• Whether the OP_RETURN message from a Blockstream address is authentic is uncertain.
• Future actions of the hackers, such as returning funds or demanding a fee, are speculative.

Impact on users

L‑BTC holders cannot currently redeem their tokens for underlying bitcoin because the federation’s BTC reserve has been largely depleted. Exchanges have paused L‑BTC deposits and withdrawals, and wallets that rely on Liquid may be affected. The incident could reduce confidence in the Liquid sidechain if the funds are not recovered.

Next steps

Liquid Network officials have asked exchanges to suspend L‑BTC activity while they investigate. Users are advised to monitor communications from the alleged hackers and the Liquid Network for any updates on fund recovery.

Sources

• Bitcoin Magazine