Blockstream's Liquid Bitcoin Network Halted After $320 Million Withdrawal, Sender Claims to Be a 'White Hat'

The reserve emptied out in hours

Blockstream's Liquid Network, a Bitcoin sidechain launched in 2018 to speed up transfers between exchanges, saw its federation wallet drop from roughly 4,200 BTC to about 207 BTC on Sunday, according to Bitcoin.com News, which cited onchain researcher Ergo BTC. That's a swing of nearly 4,000 BTC, worth around $319 million to $320 million depending on which report's price snapshot you use.

The first transaction cleared at 14:06 UTC, moving 3,996 BTC, about 95% of the network's holdings, to an address that had never been used before, according to Bitcoin Ethereum News. Roughly four hours later, the sender moved the coins again, this time paying about 21 cents in fees (269 satoshis) and attaching an OP_RETURN message readable on the public blockchain: "we are whitehats. contact us on chain." A tiny fraction, 0.00001 BTC, was sent back to Liquid's own address. The remaining 3,998.49 BTC had not moved again as of that report.

Blockstream confirms the incident, says keys weren't compromised

Blockstream's official response came several hours after the funds first moved. In a statement posted to the Liquid Network account on X around 4:25 p.m. EDT, the company said: "We are aware of a security incident on Liquid BTC. Purported white-hat hackers have withdrawn ~4,000 BTC (~$320 million) from the Liquid Federation wallet. The Blockstream team is working on contacting them on-chain with a signed message."

Blockstream said the withdrawal went through the SideSwap Peg-out Authorization Key, or PAK, and that neither that key nor any other federation keys were compromised, according to Crypto Briefing and TradingView. The company has paused Liquid Bitcoin (LBTC) deposits and withdrawals, notified exchanges, and disabled bridge nodes, effectively freezing the sidechain and blocking new transactions. Other Liquid-based assets, including USDT, DePix, and tokenized real-world assets, are unaffected, Blockstream said.

Samson Mow, founder and CEO of JAN3, which builds the Aqua wallet, said on X that Aqua's Liquid functionality is impacted but that regular Bitcoin transactions on the wallet continue to work normally. "These are difficult times but we'll pull through," Mow wrote.

How the security model is supposed to work

Liquid runs on what Blockstream calls a Strong Federation: 15 vetted member companies, including past participants like Bitfinex, OKCoin, BitMEX, and SIX Digital Exchange, who collectively hold multisig keys. Moving bitcoin off the sidechain back to the Bitcoin mainchain requires signatures from at least 11 of those 15 functionaries, plus a Peg-out Authorization Key system meant to restrict withdrawals to pre-approved wallets, according to KuCoin's reporting.

Blockstream's own documentation describes that whitelist as a safeguard "to ensure that the federation always remains in full control of the BTC held by the Liquid Network." The bitcoin in this case went to a brand-new address that had no prior transaction history, according to Bitcoin Ethereum News, which is exactly what that whitelist system is supposed to prevent absent a properly authorized signer or a serious flaw.

The peg technically still balances, for now

Bitcoin Ethereum News reported that Liquid's remaining reserve, all 207.275 BTC of it, still fully backs the L-BTC tokens currently in circulation, down to the fourth decimal place. That means nobody currently holding L-BTC is under-collateralized. The Liquid rulebook requires destroying LBTC tokens before releasing the matching bitcoin, so the tokens and the coins shrank in step. That fact undercuts any claim that Liquid users are facing an immediate insolvency, though it says nothing about how nearly the entire reserve was authorized to leave in the first place.

A fair read of the skeptical case

A reasonable skeptic would point out that self-identifying as a "white hat" via an on-chain note costs nothing and proves nothing. KuCoin's reporting flags the Poly Network hack in 2021 and the Euler Finance exploit in 2023 as past cases where attackers used the same playbook, claiming benevolent intent while negotiating from a position of holding someone else's money, sometimes keeping a cut as a self-declared "bounty." Until whoever moved the funds actually returns them, engages with Blockstream's outreach, or a federation member confirms authorizing the transfer, treating the "whitehat" label as established fact would be getting ahead of the evidence.

No law enforcement agency has announced an investigation. No charges have been filed. Blockstream has not publicly accused any individual or federation member of wrongdoing, and has not said whether it believes this was an inside authorization, a bypass of the PAK whitelist, or something else. Bitcoin.com News and KuCoin both stress that as of their reporting, the cause of the transfer remains unconfirmed by Blockstream.

What happens next

The unresolved question is whether the party behind the withdrawal responds to Blockstream's on-chain signed message. Until they do, or until a federation member steps forward to explain how a transaction moving 95% of Liquid's reserve cleared its authorization checks, the sidechain remains halted, LBTC deposits and withdrawals stay frozen, and roughly $320 million in bitcoin sits untouched at an address nobody has claimed.