Supposed White-Hat Hackers Drain $320 Million in BTC From Liquid Network, Say They’ll Return It After Fix

Bitcoin Layer 2 network Liquid Network has reported a security incident in which purported white-hat hackers withdrew approximately 4,000 BTC, worth $320 million, from the Liquid Federation wallet.

Blockstream is attempting to contact the parties involved through a signed on-chain message.

Network Bug Must Be Fixed First

Liquid said other assets on the network, including USDT, DePix and real-world assets, were not affected. The network has also temporarily disabled its bridge nodes, meaning new transactions cannot be submitted. As a result, the sidechain is effectively paused while the issue is being addressed.

“Liquid wallets will be impacted, and we’re sorry for any inconvenience. Federation members are actively working on resolving this so we can restore normal network activity.”

The public back-and-forth between Blockstream and the party claiming to be the white-hat hacker behind the withdrawal is continuing on-chain. According to Samson Mow, the hacker appears to prefer communicating publicly rather than via email, and is posting messages via Bitcoin transaction data.

The exchange began at 11:30 AM PDT, when the hacker wrote, “we are whitehats. contact us on chain.” Blockstream responded at 12:31 PM on September 6 and asked the hacker to contact its security team by email. Later, Blockstream sent an encrypted, PGP-signed message to the hacker’s key.

You may also like:

• Bitcoin’s Link to Gold Hits a 6-Year High as Tech Correlation Fades: Why It Matters
• Bitcoin Holders Just Cashed Out 110,000 BTC in Profits: Is a Bigger Price Drop Coming?
• Standard Chartered Extends Institutional Bitcoin and Ether Spot Trading to the UAE

At 7:20 PM, the hacker said they planned to send most of the funds back and asked whether a specified address was acceptable. About an hour later, they said the bug needed to be fixed first, and added,

“The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix.”

Blockstream replied, “Yes, thank you,” at 8:30 PM. As of 9:12 PM PDT, around 3,998.5 BTC remained unmoved. There were no further messages from either side.

Unusual Hacker Behavior

Ledger CTO Charles Guillemet was skeptical of the white-hat claim and pointed out that legitimate security researchers would not typically drain a bridge and then ask to be contacted on-chain.

He drew parallels with the Ronin hack, in which attackers stole around $625 million after compromising validator keys, and the Euler exploit, where the attacker sought to negotiate the return of funds after the theft.

The move to Signal also did little to change Guillemet’s opinion that the behavior was unlike usual white-hat activity. Despite this, the exec noted that criminal groups do not typically reach out to their victims either.