Liquid Sidechain Paused After 3,998 BTC Leaves Federation Wallet

Blockstream's Liquid disabled its bridge nodes on Sunday after almost the entire bitcoin reserve backing L-BTC was withdrawn to a single address, whose owner wrote “we are whitehats” into a bitcoin transaction.

Blockstream's Liquid sidechain is paused after nearly all the bitcoin held in its federation wallet was withdrawn on Sunday, and the recipient identified themselves onchain as white hats.

Liquid said the money left through a working authorization key rather than a stolen one, which leaves the route into the peg unexplained. The wallet that backs every L-BTC in circulation now holds 197.47 BTC.

Two transactions moved it. The first, confirmed in block 965780 at 14:01 UTC, sent 2.5 BTC. The second, twenty-seven minutes later, sent 3,995.99999857 BTC. Both landed at bc1ql4mfu6aundtkksxklfajs2h3t9nzcd6gyqjlte, which now holds 3,998.49748445 BTC, worth about $319.5 million at bitcoin's price of $79,901, per CoinGecko. Bitcoin was up 0.10% on the day.

We Are Whitehats

Four hours after the second withdrawal, the address consolidated the funds into a single output and attached a message in an OP_RETURN field: “we are whitehats. contact us on chain.” The same transaction sent 1,000 satoshis back to the federation wallet it had just emptied.