Blockstream's Liquid Network hit for roughly $319 million in BTC
Security & Exploits ·
A group claiming to be whitehats moved about 4,000 bitcoin off the Liquid Network and left an onchain note asking to be contacted.
Blockstream's Liquid Network was reportedly exploited for approximately 4,000 BTC, valued at $318.93 million, according to a post from Onchain Lens. The funds moved to an address where the attackers left a message reading "we are whitehats. contact us on chain," visible on the associated transaction.
Liquid is a Bitcoin sidechain built by Blockstream, designed to let funds move off the main Bitcoin chain and back through a federated bridge. An exploit of this scale on that bridge means roughly 4,000 BTC left the network's custody, raising questions about how the funds were extracted and whether they can be recovered or will be returned as the attackers' message implies.
The self-described "whitehat" framing is contested. Coverage of the incident notes that the attacker's narrative has been met with skepticism, with Ledger's CTO and Blockstream reportedly disputing the characterization of the withdrawal as a benign security exercise rather than a theft.
Multiple accounts describe the same core facts — the roughly 4,000 BTC figure, the onchain contact request, and the Liquid Network as the source — with additional detail circulating via wublockchain.xyz. Four distinct sources have covered the cluster so far, generally converging on the amount and the onchain message while diverging on how to characterize the actor's intent.
Unresolved is whether the group behind the withdrawal will make contact as promised, whether Blockstream or any federation members will confirm the exploit's mechanism, and whether the 4,000 BTC will be returned. Also unclear is what technical weakness in the Liquid Network or its federated signing process allowed the withdrawal, and whether Blockstream will issue a formal incident report.