Liquid Network Hack: Who Pulled 4,000 BTC and What Happens Next? Liquid Network Hack headlines are spreading fast today after a group claiming to be ethical security researchers withdrew roug
Liquid Network Hack headlines are spreading fast today after a group claiming to be ethical security researchers withdrew roughly 4,000 Bitcoin, worth around $320 million, from Blockstream's Liquid Federation wallet, leaving behind an on-chain message rather than staying silent.
A wallet linked to the incident moved nearly 4,000 BTC out of the federation-controlled reserve and attached an OP_RETURN note reading "We are whitehats, contact us on-chain."
Source: OnchainLens on X
A transaction visible on public block explorers shows the bulk of those coins — roughly 3,998 BTC — being consolidated into a single address shortly after the initial withdrawal, with the accompanying message displayed directly alongside the transfer for anyone monitoring the chain to see.
Blockstream confirmed the security incident, stating that purported white-hat hackers had withdrawn the funds from the Liquid Federation wallet and that its team was actively working on contacting them on-chain using a signed message.
Source: Blockstream confirmed
The company said the withdrawal occurred through the SideSwap Peg-out Authorization Key, though it clarified that this specific key was not itself compromised, nor were any of the network's other keys—leaving the exact method still only partially explained.
Key details Blockstream has confirmed publicly include:
Roughly 4,000 Bitcoin worth about $320 million was withdrawn from the federation wallet
Withdrawal occurred through the SideSwap Peg-out Authorization Key, without that key being compromised
Exchanges have been notified and are pausing or have already paused LBTC deposits and withdrawals
Other sidechain-based assets, including USDT, DePix, and tokenized real-world assets, remain unaffected
Bridge nodes were temporarily disabled, preventing new transactions from reaching the chain
With bridge nodes disabled, the entire sidechain is effectively paused while the Federation works through the incident, meaning wallets relying on it will be impacted until normal activity resumes.
Blockstream apologized directly for the disruption while confirming that federation members are actively working toward restoring standard operations.
As of publication,the company's own status page continues to list all systems as operational, suggesting either that the incident has not yet been formally logged there or that recovery steps are already well underway.
Detail
Information
Amount reportedly withdrawn
Roughly 4,000 BTC, worth about $320 million
Method used
SideSwap Peg-out Authorization Key
On-chain message left
"We are whitehats. Contact us on-chain."
Assets confirmed unaffected
USDT, DePix, and other sidechain-based RWAs
Network status
Bridge nodes disabled; sidechain paused
Monitoring resource
Mempool's liquid.network explorer
Groups describing themselves as whitehats typically claim to move funds out of a vulnerable system specifically to prevent malicious actors from reaching them first, often followed by a return of the assets once a bounty or safe channel is arranged.
The onchain message left alongside this withdrawal fits that familiar pattern, though whether the claim holds up depends entirely on what happens next, since anyone can attach that kind of note to a transaction regardless of actual intent.
Blockstream's own statement treats the claim cautiously, noting only that the team is working to establish contact rather than confirming the funds are already considered safe.
This Liquid Network Hack story remains actively unfolding, with Blockstream having confirmed the core facts, the amount involved, the method used, and the parts of its ecosystem left untouched—while the eventual outcome still depends on whether contact with the self-described whitehats leads to a return of funds.
Anyone holding assets on the network should watch official channels closely, since wallets remain impacted and the sidechain stays paused until the Federation resolves the situation.
This content covers financial markets and is for general information only. It is not financial, investment, trading, or legal advice. Crypto assets are volatile and can lose value fast. Always do your own research. Speak with a licensed financial advisor before making investment decisions.
