Bitcoin Layer 2 community Liquid Community has reported a safety incident by which purported white-hat hackers withdrew roughly 4,000 BTC, value $320 million, from the Liquid Federation pockets.
Blockstream is making an attempt to contact the events concerned by way of a signed on-chain message.
Community Bug Should Be Mounted First
In an replace, Liquid mentioned the funds had been withdrawn utilizing the SideSwap PAK (Peg-out Authorization Key) however acknowledged that the important thing itself was not compromised and that no different keys had been in jeopardy. Crypto exchanges have been knowledgeable and have already suspended, or are making ready to droop, LBTC deposits and withdrawals.
Liquid mentioned different belongings on the community, together with USDT, DePix and real-world belongings, weren’t affected. The community has additionally quickly disabled its bridge nodes, which means new transactions can’t be submitted. In consequence, the sidechain is successfully paused whereas the difficulty is being addressed.
“Liquid wallets will likely be impacted, and we’re sorry for any inconvenience. Federation members are actively engaged on resolving this so we will restore regular community exercise.”
The general public back-and-forth between Blockstream and the get together claiming to be the white-hat hacker behind the withdrawal is continuous on-chain. In line with Samson Mow, the hacker seems to choose speaking publicly reasonably than through e-mail, and is posting messages through Bitcoin transaction information.
They even requested Blockstream to make contact on Sign at @m671aw.70″
The alternate started at 11:30 AM PDT, when the hacker wrote, “we’re whitehats. contact us on chain.” Blockstream responded at 12:31 PM on September 6 and requested the hacker to contact its safety crew by e-mail. Later, Blockstream despatched an encrypted, PGP-signed message to the hacker’s key.
The dialogue between @Blockstream and the white-hat hacker (WHH) relating to the ~4000 BTC from @Liquid_BTC is going on in public. It appears to be their desire over e-mail. Because it’s arduous to observe the chain of messages in OP_RETURN, right here’s a abstract with hyperlinks.
11:30 AM PDT -… https://t.co/IEXyFpBITx
— Samson Mow (@Excellion) September 7, 2026
At 7:20 PM, the hacker mentioned they deliberate to ship a lot of the funds again and requested whether or not a specified deal with was acceptable. About an hour later, they mentioned the bug wanted to be fastened first, and added,
“The chain is below threat at newest commit proper now. Make sure that each node is patched. Then we are going to switch the cash again safely after confirming the repair.”
Blockstream replied, “Sure, thanks,” at 8:30 PM. As of 9:12 PM PDT, round 3,998.5 BTC remained unmoved. There have been no additional messages from both facet.
Uncommon Hacker Conduct
Ledger CTO Charles Guillemet was skeptical of the white-hat declare and identified that reliable safety researchers wouldn’t sometimes drain a bridge after which ask to be contacted on-chain.
He drew parallels with the Ronin hack, by which attackers stole round $625 million after compromising validator keys, and the Euler exploit, the place the attacker sought to barter the return of funds after the theft.
The transfer to Sign additionally did little to vary Guillemet’s opinion that the habits was not like traditional white-hat exercise. Regardless of this, the exec famous that felony teams don’t sometimes attain out to their victims both.
The submit Supposed White-Hat Hackers Drain $320 Million in BTC From Liquid Community, Say They’ll Return It After Repair appeared first on CryptoPotato.