Blockstream's Liquid Network halts new transactions after “purported white-hat hackers” withdrew ~4,000 of the 4,200 bitcoin held in its federation wallet

worth millions of dollars were withdrawn from a settlement network used by cryptocurrency exchanges …

CoinDesk 2026-09-07 Omkar Godbole

Context & Ripple Effects

Liquid’s transaction halt follows a reported withdrawal from the federation wallet, with the actors describing themselves as white hats but that characterization remaining unverified. A same-day report says 3,400 BTC was returned after Blockstream patched bridge nodes, making remediation and reconciliation central to any restart.

The episode fits a familiar crypto-market stress pattern: Bitstamp suspended trading after a suspected breach in 2015, while FTX paused withdrawals during its 2022 crisis. For a settlement network used by exchanges, a halt turns a security incident into an immediate availability problem for connected venues and wallets.

First-order effects

Exchanges using Liquid for settlement and Liquid-based wallets, including AquaBitcoin, lose access to new Liquid transactions while Blockstream addresses the incident.
Blockstream must reconcile the federation wallet and validate its bridge-node patch before restoring network activity; the purported white-hat claim does not remove that operational burden.

Second-order effects

Connected exchanges and wallet providers must defer or reroute Liquid-dependent transfers, raising the value of alternative settlement paths during the pause.
The reported return of 3,400 BTC narrows the immediate asset shortfall, but it also puts the adequacy of the patch and restart process at the center of participant confidence.

Third-order effects

Repeated transaction halts after security incidents make availability and recovery governance as important as settlement speed for crypto networks seeking exchange adoption.
If exchanges respond by diversifying settlement routes, liquidity may fragment across networks rather than concentrating around a single bitcoin-based rail.

The trend: Crypto settlement infrastructure is being judged increasingly on operational resilience and recovery controls, not only on its ability to move assets.

Discussion

@liquid_btc @liquid_btc on x
We are aware of a security incident on @Liquid_BTC. Purported white-hat hackers have withdrawn ~4,000 BTC (~$320 million) from the Liquid Federation wallet. The @Blockstream team is working on contacting them on-chain with a signed message. What we know so far is that the funds w…
@excellion Samson Mow on x
Everyone is actively working to resolve this and we'll share information as the situation develops. As a @Liquid_BTC wallet, Liquid functionality in @AquaBitcoin is impacted, but Bitcoin transactions will still work normally. These are difficult times but we'll pull through. 🙏
@excellion Samson Mow on x
The working theory is that the vulnerability is with Liquid's Confidential Transactions, but devs cannot confirm at this time. The vulnerability is a node level issue and is not related to PAKs or HSMs.
@donaldevine @donaldevine on x
@Liquid_BTC @Blockstream Live by the sidechain, die by the sidechain.
@tomerstrolight Tomer Strolight on x
@Liquid_BTC ... This chain can be rolled back, right? Right?
@truthcoin Paul Sztorc on x
A thread about “Liquid” — one of Bitcoin's worst ideas ever It has just been drained of 4000 of its BTC https://x.com/...
@nod7r @nod7r on x
@Liquid_BTC @Blockstream Can we somehow blame Coldcard devs?
@cryptowendyo Wendy O on x
Meanwhile on Bitcoin... Sad to see.
@side_swap @side_swap on x
Re today's Liquid incident: the ~4,000 BTC peg-out went through SideSwap's peg-out service on a customer order. As @Liquid_BTC confirmed, our PAK was not compromised. The L-BTC came from an Elements bug, not from any SideSwap system. Peg-in/out paused while Liquid is. Updates her…
@bitcoinisaiah @bitcoinisaiah on x
@Liquid_BTC @Blockstream How does an attacker drain almost all the funds on a network that's supposed to be secured by a 11-15 multisig 🤔 Make it make sense.
@alanbwt Alan on x
Only the paranoid survive.
@kepleronchain Kepler on x
@Liquid_BTC @Blockstream please for the love of god make them actual whitehats. we've had enough good momentum in crypto lately, we don't need a market-wide nuke right now.
@brt2412 @brt2412 on x
@Liquid_BTC @Blockstream Another zero hash rate network bites the dust. Good riddance, should've used real BTC.
@marshallhayner Marshall Hayner on x
The entire narrative changes with @BitcoinVM_ connected to @MetalBlockchain, bridging is handled via warp messaging, secured by Snowman, direct to credit unions, banks and tradfi blockchains, no middleman.
@peruvian_bull Roberto Rios on x
It's happening again All these hacks on Bitcoin products within a month, what is going on?
@britishhodl @britishhodl on x
4000 Bitcoin have been STOLEN from the Liquid Network by “white hat” Bitcoin hackers. $322 Million. People are working (aka begging) to get Bitcoin back.
@satoshinagonna @satoshinagonna on x
@Liquid_BTC @Blockstream If it was “whitehat” then they could have used one BTC to show a vulnerability, not cleaned the network out. No bueno...
@darkwebinformer @darkwebinformer on x
🚨‼️ Liquid Network was drained of approximately 4,000 BTC, worth around $320 million, over the past several hours. The hackers left the following on-chain message: “we are whitehats. contact us on chain” Blockstream responded on-chain with:
@mrsaneapps MrSane on x
@Liquid_BTC @Blockstream BTC is dead unless it finds a way to securely scale and be private. Anyone refusing to see this is just blind at this point.
@watcherguru @watcherguru on x
JUST IN: 4,000 Bitcoin worth $320 million withdrawn following Liquid Network hack. The hacker is now communicating with network maintainers through on-chain Bitcoin transactions & intends to return the $BTC after the vulnerability is fixed.
@_miguelmedeiros Miguel Medeiros on x
The Liquid attacker is now doing Blockstream's release management. 🤣 “Please fix the bug first. The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix.
@mempool @mempool on x
our real-time audit of the https://liquid.network/ federation holdings shows an unauthorized -4019 BTC withdrawal
@stokr_io @stokr_io on x
We are aware of the security incident affecting the Liquid Network's bitcoin peg. Digital securities issued through STOKR on Liquid are not impacted. They are issued as AMP assets, independent of L-BTC, and Liquid has confirmed that RWAs are unaffected by the incident. (1/2)
@bitcoinmagazine @bitcoinmagazine on x
JUST IN: Hackers have stolen ~4,000 Bitcoin worth $320 million from the Liquid Network 🚨 The hackers claim to be white hat hackers, and said to “contact us on chain” 👀
r/Bitcoin r on reddit
Liquid Network appears to have been stalled for 5 hours and had 4,000 BTC moved without authorization.
@p3b7_ Charles Guillemet on x
So, 3,400 BTC were refunded. The “white hats” still hold 600 BTC. If this was ever a negotiated reward under an encrypted contract signed on-chain, it looks more like extortion than white-hat hacking! Let's see what happens to these 600 BTC...
@grassfedbitcoin @grassfedbitcoin on x
It's *not* an inside job. Andy wasn't running a Ponzi Scheme and Blockstream absolutely did *not* pull off a fake hack, stealing their own money and giving it back to themselves minus the money they needed (~$50m or so) to keep the game of musical chairs going. It's totally a thi…
@adamsimecka Adam Simecka on x
Well, they found the bug that drained the Liquid Federation. It's not good. From what we can tell, Blockstream recently found a vulnerability from 2019. I am going to leave individual names out, because this is ultimately Blockstream's responsibility. They were actively patching …
@adamsimecka Adam Simecka on x
Confirmed. Liquid has received the majority of their bitcoin back. Now, they just have a $47M hole to fill. I assume that responsibility lies solely on Blockstream, as they were the ones that caused this vulnerability.
@thedesertlynx Joel Valenzuela on x
This is the most embarrassing moment in Bitcoin's modern history. 😭 Blockstream, the company headed by “cYpHeRpUnK LeGeNd
@jeremiahrogers Jeremiah on x
Yeah this whole thing is wild. The anger you are seeing directed at Adam Back is because he positioned himself as the “expert elder” and led a lot of the culture in crypto towards Bitcoin and away from other projects. Often with toxicity. A lot of that “wise elder
@financeguy74 Seán Murray on x
So 600 BTC from untouched 2010 addresses woke up the same time that a white hat hacker took a 600 BTC “bounty” from Liquid Network? Weird
@side_swap @side_swap on x
Statement on today's Liquid incident Today at 14:05 UTC a customer sent 4,000 L-BTC to the SideSwap peg-out service. Our service processed it like any other order: the L-BTC was burned on Liquid with a valid peg-out authorisation, and at 14:28 UTC the Liquid Federation paid 3,996…
@intangiblecoins Alex Thorn on x
🚨💧 LIQUID HACKERS RETURN 85% OF STOLEN BITCOIN TO LIQUID FEDERATION after a lengthy conversation with blockstream via OP_RETURNs, in block 965,950 hackers sent 3400 BTC back to the original Liquid Federation address, apparently keeping 598.5 BTC (~$47m) for themselves (15%)
@excellion Samson Mow on x
Update: ...The network remains paused while Blockstream and Federation members make additional fixes and security improvements, resolve the chain split, and prepare for a safe restart. Liquid wallets and services will continue to be affected during this time. No user action is …
@excellion Samson Mow on x
The discussion between @Blockstream and the white-hat hacker (WHH) regarding the ~4000 BTC from @Liquid_BTC is happening in public. It seems to be their preference over email. As it's hard to follow the chain of messages in OP_RETURN, here's a summary with links. 11:30 AM PDT - W…
@intangiblecoins Alex Thorn on x
full dialog between blockstream and the hackers
@_miguelmedeiros Miguel Medeiros on x
IT'S HAPPENING. The Liquid attacker just broadcast the return: 3,400 BTC to the federation address. Kept 598.5 BTC for himself. About 15%. “Sending most back” was literal. After 11 rounds of OP_RETURN drama, PGP signatures and Electrum tutorials, the whitehat bounty was appa…
@moo9000 Mikko Ohtamaa on x
600 BTC is a fair bounty to deal with Bitcoin maxis
@mattjay Matt Johansen on x
Name your price bug bounty
@_miguelmedeiros Miguel Medeiros on x
The return tx is RBF-enabled. The attacker could've bumped the fee himself for a few thousand sats. Instead someone paid the https://mempool.space/ accelerator, the tool you use when you can't sign the tx. Blockstream really didn't want that RBF window open with 3,400 BTC on the …
@intcyberdigest @intcyberdigest on x
‼️ Self-proclaimed whitehat hackers used a vulnerability to drain Liquid Network of 4000 BTC ($320M USD) yesterday. Just now they've returned 3400 BTC and kept 600 BTC ($47M) as a ‘bug bounty’. They've also ‘responsibly’ disclosed the vulnerability in a PGP-encrypted message.
@k_firsov Kirill Firsov on x
Whoever did this, don't call yourself a white hat. You're just a thief with a PR strategy. Our team at @FearsOff recently found a huge vulnerability in one of the top crypto projects. We could have moved millions. We didn't. We sent a ~$100 proof transaction and got it fixed. Tha…
@_miguelmedeiros Miguel Medeiros on x
Round 15. Blockstream replies again. PGP-signed, encrypted, confirmed in block 965962. That's four encrypted messages back and forth since the 3,400 BTC return. The attacker still holds 598.5 BTC. The conversation isn't over. The telenovela continues. 🍿👀 https://mempool.space/...
@_miguelmedeiros Miguel Medeiros on x
Round 12. Ten minutes after returning 3,400 BTC, the attacker sends Blockstream another encrypted OP_RETURN message. Still holding 598.5 BTC. The finale had a post-credits scene. 🍿👀 https://mempool.space/...
@pledditor @pledditor on x
A 600 BTC shortfall in reserves is still a lot of money, about ~$48m. A relaunch + bitfinex style haircut + shitcoin may work, but it would be pretty awkward for Adam Back to launch an altcoin. The entire selling point of Liquid was that it operated without a shitcoin
@_miguelmedeiros Miguel Medeiros on x
CONFIRMED. Block 965950, mined by Foundry. 3,400 BTC back in the Liquid federation wallet. Attacker keeps 598.5 BTC. 27 hours from the fork to the return. 11 rounds of OP_RETURN, PGP signatures, an Electrum tutorial and a https://mempool.space/ accelerator. All settled on-chain, …
@csuwildcat @csuwildcat on x
One interesting thing I learned from the Liquid hacker situation: many people aren't familiar with how per se crimes work. Folks seem to think that b/c Blockstream and the hacker may have had an agreement, it mitigates the crimes. That's false; per se crimes are locked in when th…
@muneeb @muneeb on x
Thoughts on the Liquid whitehat incident: Background: - Liquid is a Bitcoin L2/sidechain, launched by Blockstream in 2018. 4,000 BTC from their bridge was taken by a whitehat yesterday (and then mostly returned). - You can think of the Liquid network as running a fork of Bitcoin …
@csuwildcat @csuwildcat on x
The clearly-not-whitehat hacker kept almost 600 of the 4000 bitcoin they stole. Fun fact: engaging in a random exchange creates a cascade of new, even more serious criminal charges than if the hacker just kept it all, and law enforcement pursues it just as aggressively regardless
@jseyff James Seyffart on x
600 BTC is quite the tip hahaha. I have no idea what would be a standard acceptable bounty though? Still ... cold card victims would probably gladly give up 15% of their BTC to get back the other 85%. Doubt there'd even be any questions 🤷🏼‍♂️
@_miguelmedeiros Miguel Medeiros on x
Round 13. Blockstream replies to the attacker's post-return message. PGP-signed, encrypted, and short. About one sentence worth of ciphertext. 3,400 BTC returned, 598.5 BTC still with the attacker, and the two sides are now exchanging one-liners we can't read. Looks like the term…
@hodlmagoo Magoo PhD on x
Then worst thing the Liquid hacker did wasn't even stealing 4000 Bitcoin, it was spamming the chain with OP_RETURN messages.
@richardheartwin Richard Heart on x
.@adam3us called me a “scammer and con-artist.
@stevenroose3 Steven Roose on x
Did Blockstream offer them the 600 BTC voluntarily? Cuz if they bargained for it, that's definitely not white hat behavior. That's just a plain old ransom with negotiation.

Chronicles