Blockstream’s Bitcoin layer-2 Liquid Network halted after 4,000 BTC worth nearly $320 million left the federation wallet that backs L-BTC. The attackers left an on-chain message and claimed they are white hackers. However, Ledger CTO and others reject hackers’ white-hat claims.
Blockstream’s Liquid Network Paused as 4000 Bitcoin Leaves Federation Wallet
Liquid Network said funds were withdrawn via the SideSwap PAK (Peg-out Authorization Key), but key was not compromised. The network is halted and exchanges are notified, with Blockstream contacting hackers on-chain.
On-chain data shows two Bitcoin transactions emptied most of the reserve. Notably, a small 2.5 BTC transfer was followed by a payout of nearly 3,996 BTC. These were then moved to a single address that held about 3,998.5 BTC.
Before the incident, the federation wallet held roughly 4,200 BTC. It now holds just over 200 BTC or about 5% of the prior reserve. Meanwhile, other Liquid Network assets such as USDT, DePix, and real-world assets (RWAs) are unaffected.
“Please fix the bug first. The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix,” the hackers said in the latest on-chain message.
Does this mean they will return the BTC hacked from Liquid network?
“Sending most back to bc1qdll…wxxr, is that ok” pic.twitter.com/IxzpjItElJ
— Julio Moreno (@jjcmoreno) September 7, 2026
Ledger CTO and Others Doubt White-Hat Hackers’ Claims
Several observers reject calling the attackers white hats. Meanwhile, BTC price remained stable near $80,000. The major effect is likely on L-BTC liquidity and tokens or firms that depend on Liquid Network’s settlement layer rather than on BTC price.
Ledger CTO Charles Guillemet argued that attackers disclose a flaw before moving hundreds of millions in collateral. “White hats don’t drain a bridge and then solicit an ‘on-chain’ contact,” comparing it to the Ronin bridge hack and Euler Finance attacker’s later “let’s talk” negotiation.
Others noted that moving BTC first and announcing good intent afterward looks more like leverage than a disclosure. Former Blockstream CSO Samson Mow claimed a Signal request to contact hackers did not come from the address holding the 4,000 Bitcoin.
The request for Signal did not come from the same address.
— Samson Mow (@Excellion) September 6, 2026
Until Blockstream and the self-claimed white-hat hackers reach a public agreement, L-BTC’s peg depends on trust that the remaining reserve, a software fix, and any recovered coins will restore 1:1 backing.
This security breach on a prominent sidechain highlights why enterprises prefer secure, segregated institutional crypto custody solutions when managing digital collateral.