blockchain exploit

A $320 million Bitcoin theft from the Liquid sidechain has thrown the network into an extended outage, with alleged white-hat hackers claiming they will restore funds once Blockstream patches a claimed vulnerability. The incident raises questions about network security, federation custody, and whether the perpetrators are genuine researchers or sophisticated attackers using white-hat language as cover.

• Approximately 4,000 BTC, valued at roughly $320 million, was withdrawn from the Liquid Federation wallet via the SideSwap PAK.
• The alleged hackers communicated exclusively through on-chain Bitcoin transaction messages and refused to engage through conventional private security channels.
• Blockstream temporarily disabled bridge nodes and paused the Liquid sidechain while investigating the breach and negotiating with the perpetrators.

• 4,000 BTC Amount of Bitcoin withdrawn from Liquid Federation wallet
• $320M Approximate value of the stolen Bitcoin at time of theft
• 3,998.5 BTC Remaining unmoved balance as of final public communication
• $625M Size of Ronin bridge hack for comparison to similar incidents

The Liquid Network, a Bitcoin sidechain designed to facilitate faster transactions and enhanced privacy, experienced a significant security breach when unknown actors extracted approximately 4,000 BTC from the federation’s custody reserves. Blockstream, which operates core infrastructure for Liquid, confirmed that the theft occurred through the SideSwap Peg-out Authorization Key but stressed that the key itself was not compromised and no other federation keys face immediate risk. The Liquid Federation maintains Bitcoin reserves that back LBTC, the network’s Bitcoin-pegged asset, which serves institutional users and digital asset platforms seeking to issue tokens on a Bitcoin-based layer.

Liquid represents one of the more established Bitcoin sidechain solutions, having launched in 2018 with a focus on institutional adoption and confidential transactions. The network relies on a federation model where multiple parties hold custody keys collectively, requiring threshold signatures to authorize major transactions. This approach differs from centralized bridges but introduces custodial risk, as the recent theft demonstrates. The breach highlights ongoing challenges in securing multi-party custody arrangements, particularly when managing large reserves of high-value assets.

Hackers Initiate Public On-Chain Dialogue With Blockstream

Rather than following standard security disclosure practices, the perpetrators identified themselves as white-hat hackers and initiated contact through unconventional means. At 11:30 AM PDT, they posted a message via Bitcoin transaction data stating “we are whitehats. contact us on chain” and requested communication through Signal at @m671aw.70. Blockstream initially attempted to redirect them toward private channels by asking them to contact its security team by email and later sent an encrypted, PGP-signed message.

The alleged hackers refused to engage privately and maintained exclusive use of on-chain messaging for all subsequent communications. This departure from established vulnerability disclosure norms raised immediate red flags within the security community. At 7:20 PM PDT, they signaled intent to return most of the funds and asked whether a specified address would be acceptable for transfer. Approximately one hour later, they claimed a network bug needed to be fixed first, emphasizing the ongoing risk to chain integrity.

The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix.

Alleged hackers, in on-chain message to Blockstream

Blockstream acknowledged the request at 8:30 PM PDT with a brief “Yes, thank you,” appearing to accept the hackers’ terms for remediation.

Network Containment And Skepticism Over White-Hat Claims

Blockstream took immediate action to limit the breach’s scope by temporarily disabling bridge nodes and pausing the Liquid sidechain during the investigation. Crypto exchanges were notified and began suspending or preparing to suspend deposits and withdrawals of LBTC. Other assets on the network, including USDT, DePix, and real-world assets, remained unaffected, suggesting the incident was isolated to the federation’s Bitcoin reserves rather than representing a systemic vulnerability affecting all Liquid-based tokens.

The rapid coordination between Blockstream and exchanges reflects established practices in the industry following major security incidents. Pausing bridge operations prevented additional fund withdrawals while negotiations continued and investigation proceeded. This containment strategy prioritizes preventing further damage over maintaining normal network operations, a decision prioritizing user asset security over service continuity.

Security professionals within the cryptocurrency industry have questioned the legitimacy of the white-hat narrative. Charles Guillemet, CTO of Ledger, noted that authentic security researchers typically follow established vulnerability disclosure protocols emphasizing private communication rather than public fund transfers and on-chain negotiations. Guillemet drew parallels to the Ronin hack, in which attackers stole approximately $625 million after compromising validator keys, and the Euler exploit, where the attacker negotiated the return of stolen funds following a theft.

The distinction between genuine white-hat researchers and sophisticated attackers adopting white-hat language remains difficult to verify in cryptocurrency incidents. Authentic security researchers typically work through coordinated disclosure frameworks that prioritize protecting user funds while allowing developers time to patch vulnerabilities. Public communication via on-chain messages bypasses these safeguards and increases risk exposure. Legitimate researchers also typically do not retain custody of stolen funds pending patch deployment, as this arrangement creates counterparty risk and unusual incentive structures.

Guillemet acknowledged that criminal actors rarely contact victims after a theft, adding an additional layer of uncertainty to the incident’s true nature.

As of 9:12 PM PDT, approximately 3,998.5 BTC remained unmoved in the hackers’ possession, and no further messages were exchanged between the parties. The cryptocurrency community awaits confirmation that Blockstream has patched the alleged vulnerability and whether the perpetrators will follow through on their stated commitment to return the stolen funds. This incident underscores broader questions about federation security models and custodial arrangements in decentralized finance, particularly regarding how institutional infrastructure manages large asset concentrations.