Attackers Drained 4,000 Bitcoin From Blockstream's Liquid Network. They Say They Are White Hats and Want to Give It Back.

A bug in Liquid's code let someone mint Bitcoin-backed tokens out of thin air, drain 95% of the federation wallet, and then claim they did it to help. Whether that story holds up depends on what happens to the coins…

This post may contain links from our sponsors and affiliates, and Flywheel Publishing may receive compensation for actions taken through them.

Around 4,000 Bitcoin (CRYPTO:BTC), worth about $320 million, drained out of the Liquid Network federation wallet on September 6, 2026, and Blockstream says no private key was stolen. The wallet held about 4,200 BTC before, so 95% of the Bitcoin backing the sidechain left in one transaction. Blockstream paused the network and blocked redemptions, so holders of L-BTC, the token meant to represent Bitcoin one-for-one on Liquid, can’t convert it back into real coins.

Ordinary Bitcoin holders on the base layer aren’t affected, with Bitcoin’s price trading around $79,700–$80,000 at the time of the incident. The attackers attached a message to the transaction saying, “we are whitehats. contact us on chain,” and Blockstream responded on-chain the same day. A white hat is generally expected to report a vulnerability responsibly rather than take funds first, which makes the incident harder to classify. So how much of this is a real security event, and how much is theater?