‘White hats’ take 4000 BTC from Liquid, ETFs see best week of 2026: Hodler’s Digest

Liquidated: ‘All your Bitcoin are belong to us’

A shade under 4000 Bitcoin worth $319 million has been taken from Liquid Network — with purported “white hat” hackers claiming responsibility. An unverified OP_RETURN message read: “we are whitehats. contact us on chain.”  

The Blockstream-run Bitcoin sidechain has paused bridge nodes and told exchanges to pause LBTC deposits and withdrawls as the team attempts to contact the attackers and identify the security holes. The Liquid explorer shows the balance of its federation wallet dropped from 4,200 BTC down to just 207.275 BTC.

Under normal Liquid mechanics, LBTC is burned on the sidechain before Bitcoin is withdrawn. In simple terms, the transaction needs to be authorized by an 11 of 15 multisig with funds sent to an approved whitelist.    

Liquid Network posted earlier today that: “the funds were withdrawn via the SideSwap PAK (Peg-out Authorization Key), but that key was not compromised, nor were any others.” 

“Bridge nodes have been temporarily disabled, so no new transactions can be submitted to the network. Effectively, the Liquid sidechain is paused until this issue is resolved.”

Crypto analyst DBCrypto noted that: “the coins aren’t running and they’re just sitting on Bitcoin and haven’t been mixed. That’s more consistent with a whitehat extraction than a theft.” But he said the incident raised some big questions about security on the sidechain. “Either 11 of 15 functionaries signed this off, or the whitelist built to prevent exactly this didn’t hold. Neither answer makes Liquid look good.”