Menu

cryptocurrency hack

Suspected Security Researchers Extract $320 Million in Bitcoin From Liquid Network While Pledging to Return Stolen Assets After Settlement

Suspected Security Researchers Extract $320 Million in Bitcoin From Liquid Network While Pledging to Return Stolen Assets After Settlement

, , , , , ,

A $320 million Bitcoin theft from the Liquid sidechain has thrown the network into an extended outage, with alleged white-hat hackers claiming they will restore funds once Blockstream patches a claimed vulnerability. The incident raises questions about network security, federation custody, and whether the perpetrators are genuine researchers or sophisticated attackers using white-hat language as cover.

  • Approximately 4,000 BTC, valued at roughly $320 million, was withdrawn from the Liquid Federation wallet via the SideSwap PAK.
  • The alleged hackers communicated exclusively through on-chain Bitcoin transaction messages and refused to engage through conventional private security channels.
  • Blockstream temporarily disabled bridge nodes and paused the Liquid sidechain while investigating the breach and negotiating with the perpetrators.
  • 4,000 BTC Amount of Bitcoin withdrawn from Liquid Federation wallet
  • $320M Approximate value of the stolen Bitcoin at time of theft
  • 3,998.5 BTC Remaining unmoved balance as of final public communication
  • $625M Size of Ronin bridge hack for comparison to similar incidents

The Liquid Network, a Bitcoin sidechain designed to facilitate faster transactions and enhanced privacy, experienced a significant security breach when unknown actors extracted approximately 4,000 BTC from the federation’s custody reserves. Blockstream, which operates core infrastructure for Liquid, confirmed that the theft occurred through the SideSwap Peg-out Authorization Key but stressed that the key itself was not compromised and no other federation keys face immediate risk. The Liquid Federation maintains Bitcoin reserves that back LBTC, the network’s Bitcoin-pegged asset, which serves institutional users and digital asset platforms seeking to issue tokens on a Bitcoin-based layer.

Liquid represents one of the more established Bitcoin sidechain solutions, having launched in 2018 with a focus on institutional adoption and confidential transactions. The network relies on a federation model where multiple parties hold custody keys collectively, requiring threshold signatures to authorize major transactions. This approach differs from centralized bridges but introduces custodial risk, as the recent theft demonstrates. The breach highlights ongoing challenges in securing multi-party custody arrangements, particularly when managing large reserves of high-value assets.

Hackers Initiate Public On-Chain Dialogue With Blockstream

Rather than following standard security disclosure practices, the perpetrators identified themselves as white-hat hackers and initiated contact through unconventional means. At 11:30 AM PDT, they posted a message via Bitcoin transaction data stating “we are whitehats. contact us on chain” and requested communication through Signal at @m671aw.70. Blockstream initially attempted to redirect them toward private channels by asking them to contact its security team by email and later sent an encrypted, PGP-signed message.

The alleged hackers refused to engage privately and maintained exclusive use of on-chain messaging for all subsequent communications. This departure from established vulnerability disclosure norms raised immediate red flags within the security community. At 7:20 PM PDT, they signaled intent to return most of the funds and asked whether a specified address would be acceptable for transfer. Approximately one hour later, they claimed a network bug needed to be fixed first, emphasizing the ongoing risk to chain integrity.

The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix.

Alleged hackers, in on-chain message to Blockstream

Blockstream acknowledged the request at 8:30 PM PDT with a brief “Yes, thank you,” appearing to accept the hackers’ terms for remediation.

Network Containment And Skepticism Over White-Hat Claims

Blockstream took immediate action to limit the breach’s scope by temporarily disabling bridge nodes and pausing the Liquid sidechain during the investigation. Crypto exchanges were notified and began suspending or preparing to suspend deposits and withdrawals of LBTC. Other assets on the network, including USDT, DePix, and real-world assets, remained unaffected, suggesting the incident was isolated to the federation’s Bitcoin reserves rather than representing a systemic vulnerability affecting all Liquid-based tokens.

The rapid coordination between Blockstream and exchanges reflects established practices in the industry following major security incidents. Pausing bridge operations prevented additional fund withdrawals while negotiations continued and investigation proceeded. This containment strategy prioritizes preventing further damage over maintaining normal network operations, a decision prioritizing user asset security over service continuity.

Security professionals within the cryptocurrency industry have questioned the legitimacy of the white-hat narrative. Charles Guillemet, CTO of Ledger, noted that authentic security researchers typically follow established vulnerability disclosure protocols emphasizing private communication rather than public fund transfers and on-chain negotiations. Guillemet drew parallels to the Ronin hack, in which attackers stole approximately $625 million after compromising validator keys, and the Euler exploit, where the attacker negotiated the return of stolen funds following a theft.

The distinction between genuine white-hat researchers and sophisticated attackers adopting white-hat language remains difficult to verify in cryptocurrency incidents. Authentic security researchers typically work through coordinated disclosure frameworks that prioritize protecting user funds while allowing developers time to patch vulnerabilities. Public communication via on-chain messages bypasses these safeguards and increases risk exposure. Legitimate researchers also typically do not retain custody of stolen funds pending patch deployment, as this arrangement creates counterparty risk and unusual incentive structures.

Guillemet acknowledged that criminal actors rarely contact victims after a theft, adding an additional layer of uncertainty to the incident’s true nature.

As of 9:12 PM PDT, approximately 3,998.5 BTC remained unmoved in the hackers’ possession, and no further messages were exchanged between the parties. The cryptocurrency community awaits confirmation that Blockstream has patched the alleged vulnerability and whether the perpetrators will follow through on their stated commitment to return the stolen funds. This incident underscores broader questions about federation security models and custodial arrangements in decentralized finance, particularly regarding how institutional infrastructure manages large asset concentrations.

Cosmos Labs acknowledges faulty approval of the flaw responsible for a $5.7 million theft spanning six blockchain networks

Cosmos Labs acknowledges faulty approval of the flaw responsible for a $5.7 million theft spanning six blockchain networks

, , , , ,

Cosmos Labs has admitted to improperly approving a security vulnerability that led to a coordinated attack across six blockchain networks, resulting in $5.7 million in losses. The incident exposes critical gaps in how major blockchain infrastructure providers communicate and coordinate security patches with their ecosystem partners.

  • MANTRA Chain lost $3.6 million in the attack, the largest single loss among six affected chains in the multi-chain exploit.
  • Cosmos Labs released the security patch only 20 hours before attackers exploited the vulnerability across the networks.
  • The patch lacked clear documentation identifying which specific vulnerability it was designed to address, hampering risk assessment.
  • $5.7M Total losses across six blockchain networks hit in coordinated attack
  • $3.6M Losses sustained by MANTRA Chain, largest single loss among affected chains
  • 20 hours Time between patch release and attack commencement across networks
  • 6 Total number of blockchain networks compromised in the broader attack

Cosmos Labs has acknowledged that it improperly cleared a security vulnerability that subsequently enabled a multi-chain attack resulting in $5.7 million in losses across six blockchain networks. MANTRA Chain, which sustained $3.6 million in damages from the incident, contended that Cosmos Labs released the patch addressing the flaw merely 20 hours prior to when the attack commenced. According to MANTRA Chain, the security update failed to explicitly identify which vulnerability it was designed to remediate.

Cosmos Labs’ Failure to Document the Patched Vulnerability

The absence of clear documentation about which specific vulnerability a patch addresses represents a critical breakdown in security communication. When a security update is released without accompanying details, developers and security teams at dependent projects face significant challenges in determining whether the patch is urgent and whether their systems are affected. This ambiguity can lead to delayed patching, as teams may deprioritize updates when the nature and severity of addressed issues remain unclear.

Industry best practices call for security advisories to include technical details about the vulnerability, its potential impact, affected versions, and mitigation strategies. Clear identification of the CVE or internal vulnerability number allows projects to cross-reference the issue with other disclosures and assess their exposure systematically. The lack of such documentation in this incident appears to have left chains like MANTRA Chain scrambling to understand what had been fixed and whether urgent action was required.

This documentation gap is particularly problematic in the blockchain industry, where security vulnerabilities can expose digital assets worth substantial sums to immediate risk. Projects operating on the Cosmos network depend on receiving clear, actionable information from the core development team to prioritize their response efforts and allocate resources appropriately.

Compressed Timeline Between Patch Release and Exploitation

The 20-hour window between patch release and the attack’s commencement raises serious questions about whether adequate time was provided for security teams to apply updates. A timeline this compressed suggests that coordination mechanisms between Cosmos Labs and downstream projects may be insufficient for the scale and interconnectedness of the ecosystem.

In the blockchain context, where nodes must be updated across distributed networks and consensus mechanisms must be maintained, 20 hours is a remarkably tight timeline. Network operators need time not only to assess patches but also to coordinate updates across validator sets, test changes in staging environments, and execute updates in ways that maintain network stability. The compressed timeline suggests either that the vulnerability was initially kept under embargo for insufficient duration, or that information about the vulnerability leaked before the patch was ready for widespread deployment.

Coordinating security patches across a network of independent validators and node operators typically requires substantially more lead time than 20 hours. Many projects schedule regular maintenance windows for infrastructure updates and may not be able to respond to emergency patches on such short notice without creating network disruption or stability concerns.

Systemic Risks Across Interconnected Blockchain Infrastructure

The Cosmos ecosystem comprises hundreds of blockchain projects ranging from specialized application chains to dedicated infrastructure networks. Built on the Cosmos SDK and utilizing the Tendermint consensus engine, many of these projects rely heavily on libraries, modules, and security updates distributed by Cosmos Labs. This interconnected architecture, while offering substantial benefits in terms of flexibility and efficiency, creates systemic risks where vulnerabilities in core infrastructure can cascade across multiple networks simultaneously.

The multi-chain nature of the attack demonstrates how interconnected modern blockchain ecosystems have become and how vulnerabilities in shared infrastructure can create systemic risks affecting multiple dependent networks. Unlike isolated blockchain systems, ecosystems like Cosmos introduce dependencies that can amplify the impact of security oversights across the entire network of connected chains.

The incident has prompted discussions within the Cosmos community about establishing more formal security coordination procedures, with projects increasingly recognizing that mature security practices are essential components of sustainable blockchain infrastructure. As blockchain technology continues to mature, organizations like Cosmos Labs face ongoing pressure to balance transparency with security, providing adequate warning to partners while not disclosing vulnerability details that could aid attackers.

Back To Top
© BlockWest 2026
BlockWest Media LLC

Equities, AI, and blue-chip crypto, covered as one connected market.

Sections

Company

Legal

Follow

𝕏 ▶ in

© 2026 BlockWest. All rights reserved.