Macro
Alleged White-Hat Hackers Withdraw $320 Million from Blockstream's Liquid Network
On September 6, 2026, Blockstream's Liquid Network experienced a major security incident as alleged white-hat hackers withdrew about 4,000 BTC, equivalent to roughly $320 million, from its federation wallet. The transaction, which cost only 21 cents in fees, raised eyebrows as the hackers left a message on the blockchain stating, "we are whitehats. contact us on chain." This incident has sparked discussions about the security of the Liquid Network and the implications for its users.
The withdrawal represented approximately 95% of the Liquid Network's total reserves, which had been reported at over 4,200 BTC before the incident. Following the withdrawal, Blockstream confirmed that the remaining coins were still fully covered, alleviating immediate concerns about insolvency. However, the circumstances surrounding the withdrawal have led to speculation about a potential exploitation of a consensus bug within the Liquid sidechain.
Blockstream's Liquid Network operates on a federated model, requiring signatures from 11 of its 15 member companies to authorize transactions. The hackers reportedly exploited an inflation bug to create non-existent LBTC, which they then cashed out for on-chain BTC. As a precaution, Blockstream has paused bridge nodes and advised exchanges to halt L-BTC deposits and withdrawals.
Despite the significant amount of BTC involved, the hackers have yet to move the majority of the funds from the new address they created. This has led to speculation that they may be open to negotiations, potentially asking for a finder’s fee in exchange for returning the stolen assets. Meanwhile, users holding L-BTC are left in a precarious position, with their assets effectively frozen until a resolution is reached.
FAQ
What happened on September 6, 2026, with Blockstream's Liquid Network?
On September 6, 2026, Blockstream's Liquid Network experienced a security incident where alleged white-hat hackers withdrew approximately 4,000 BTC, worth around $320 million, from its federation wallet.
How did the hackers manage to withdraw such a large amount of BTC?
The hackers reportedly exploited an inflation bug to create non-existent LBTC, which they then exchanged for on-chain BTC. This allowed them to withdraw a significant portion of the Liquid Network's reserves.
What measures has Blockstream taken following the incident?
Blockstream has paused bridge nodes and advised exchanges to halt L-BTC deposits and withdrawals to prevent further issues while they investigate the incident.
What does the term 'white-hat hackers' mean in this context?
'White-hat hackers' refer to individuals who use their hacking skills for ethical purposes, often to identify and fix security vulnerabilities. In this case, the hackers claimed to be white-hats and left a message on the blockchain indicating their intentions.
What is the current status of the funds withdrawn by the hackers?
As of now, the hackers have not moved the majority of the funds from the new address they created, leading to speculation that they may be open to negotiations for returning the assets.