Attackers Leave On-chain Message After $320 Million Exits Liquid Network
Someone pulled $319 million in Bitcoin (BTC) out of Blockstream’s Liquid network on Sunday. It cost 21 cents in fees. Then they left a note on the blockchain saying they were the good guys.
While the internet calls it a heist, the chain says something stranger. Liquid’s remaining coins are still fully covered, down to the fourth decimal place.
We are aware of a security incident on @Liquid_BTC. Purported white-hat hackers have withdrawn ~4,000 BTC (~$320 million) from the Liquid Federation wallet. The @Blockstream team is working on contacting them on-chain with a signed message.
— Liquid Network 🌊 (@Liquid_BTC) September 6, 2026
What we know so far is that the funds…
Follow us on X to get the latest news as it happens
$320M Crypto Reserve Moves, But the Wallet Left a Strange Message
The first move cleared at 14:06 UTC, releasing 3,996 coins to an address nobody had ever used before. That was 95% of everything the network held.
Four hours later the money moved again. The sender paid 269 satoshis, about 21 cents, and attached a message anyone can read.
Then they sent 0.00001 back to Liquid’s own address. The other 3,998.49 coins have not moved since.
“It looks like ~4,000 BTC just moved from the Liquid Network bridge all at once with an OP Return saying, “we are whitehats. contact us on chain”,” one user noted.
The Part Everyone Missed
Liquid runs on one rule: To take coins out, you destroy the matching tokens inside the network first. So when the reserve shrank, the tokens it backs shrank with it. Both landed in nearly the same spot.
Liquid got got?
— ∴FreeSamourai∴ (@ErgoBTC) September 6, 2026
Liquid Pegout tx 4000/4200 BTC
8db751a650ae2f12006b7e8c69a75e4df360e8afd6b9e05ae0b9fa6458a7b140
Hacker message: "we are whitehats. contact us on chain"
c103de95817b43f2df635ec6f35ff126ca26a7c6d20570c4b01866b2b3e69a19
The peg holds, with 0.22 coins to spare. Nobody still holding L-BTC is short a satoshi. That kills the insolvency story. However, it leaves a worse one. Add what left to what remains, and the network held about 4,193 coins on Saturday. Nearly all of them were burned to make this move work.
Blockstream is clear about who can do that. Only a federation member can burn the tokens. Fifteen companies hold the keys, and 11 must sign before coins leave.
Its documentation calls the destination list a safeguard.
Whitelisted addresses are used as a failsafe to ensure that the federation always remains in full control of the BTC held by the Liquid Network,” the team said in its documentation.
The coins went to a brand new address. Blockstream has not explained that, or said anything at all.
Traders have seen this before, particularly with Ronin bridge attackers who gave back $10 million and took a bounty in 2024.
The money sits still, in daylight. Whoever holds it asked to be contacted. Nobody has answered.