Bitcoin sidechain Liquid pauses after purported ‘white hats’ withdraw $320M in BTC

Details

The actors told Blockstream they would return most of the 4,000 BTC after the Elements vulnerability is patched across the network.

[Update, Sept. 7, 2026, 7:30 UTC: Added correspondence between the “white hats” and Blockstream.]

Bitcoin sidechain Liquid paused operations after actors claiming to be white-hat hackers withdrew about 4,000 Bitcoin worth $320 million from its federation wallet.

On Sunday, Liquid said that bridge nodes were disabled, preventing new transactions, while exchanges had halted or were preparing to halt L-BTC deposits and withdrawals. Other assets issued on Liquid, including USDT, DePix and real-world assets, were unaffected, according to the network.

Blockstream, Liquid’s technology provider, contacted the actors through signed onchain messages. The actors said they would return most of the Bitcoin after the vulnerability was fixed and every node had installed the patch. At the time of writing, the funds had not been returned.

The withdrawal represented roughly 95% of the wallet’s approximately 4,200 BTC balance. Liquid uses Bitcoin held through its federation to back L-BTC issued on the sidechain, leaving most of the wallet’s BTC under the actors’ control until the funds are returned.

Cointelegraph reached out to Liquid Network and Blockstream for comment.

Purported white hats negotiate with Blockstream

In an X post, Jan3 CEO and former Blockstream chief strategy officer Samson Mow compiled a detailed timeline of the public messages embedded in Bitcoin transactions.

The exchange began at 11:30 am Pacific time, when the actors identified themselves as white hats and requested onchain contact. Blockstream responded about an hour later, directing them to its security email, and subsequently sent a PGP-encrypted message.

Hours later, the actors asked whether they could return most of the Bitcoin to a Blockstream address. They then demanded that the vulnerability be fixed and every node updated before transferring the funds.

Related: Satoshi-era Bitcoin wakes after 16 years of dormancy as 600 BTC moves

Mow said it was answering the return-address question, not the patching condition. Around 3,998.5 BTC remained unmoved by that point, with no further messages as of 9:12 pm Pacific time.

SideSwap said the withdrawal passed through its peg-out service as a customer order using its Peg-out Authorization Key (PAK), but that the key was not compromised. It said the L-BTC used in the transaction originated from a bug in Elements, the open-source software underpinning Liquid, rather than SideSwap’s systems.

Magazine: ‘White hats’ take 4000 BTC from Liquid, ETFs see best inflows of 2026: Hodler’s Digest

Subscribe to daily byte-sized crypto news from Cointelegraph

‘White hats’ take 4000 BTC from Liquid, ETFs see best inflows of 2026: Hodler’s Digest

Satoshi-era Bitcoin wakes after 16 years of dormancy as 600 BTC moves

Bitcoin ETF inflows hit $731M, highest since January as BTC reclaims $80K

‘White hats’ take 4000 BTC from Liquid, ETFs see best inflows of 2026: Hodler’s Digest

Satoshi-era Bitcoin wakes after 16 years of dormancy as 600 BTC moves

Bitcoin ETF inflows hit $731M, highest since January as BTC reclaims $80K

Bitcoin sidechain Liquid pauses after purported ‘white hats’ withdraw $320M in BTC

Markets tilt toward September rate hikes: Five things to know in Bitcoin this week

Token buybacks are booming. But are they good for crypto projects?

Bitcoin ETF inflows hit $3.8B in strongest three-week stretch of 2026

Harmony proposes shutting down layer 1, migrating ONE to Ethereum

Cointelegraph is committed to providing independent, high-quality journalism across the crypto, blockchain, AI, and fintech industries.

All news, reviews, and analyses are produced with full journalistic independence and integrity. For more details on our standards and processes, please read our Editorial Policy .

Related Coins

BTC

Source

Cointelegraph RSS