Alleged White-Hat Hackers Return $263M to Liquid Network

Alleged white-hat hackers returned 3,400 bitcoin to the Liquid Network after an attack on the sidechain over the weekend. Liquid disabled nodes and suspended transactions while roughly 598 bitcoin remain missing.

The Blockstream-developed sidechain reported the funds were taken from its federation wallet, which held about 4,200 BTC before the breach. Liquid said exchanges were notified and LBTC deposits and withdrawals were paused to limit further risk.

Liquid reported the withdrawals used the SideSwap PAK (Peg-out Authorization Key) but stated the key itself was not compromised. The company warned Liquid wallets would be affected and apologized for the disruption. Other assets on the sidechain, including USDT, DePix and tokenized real-world assets, were not affected.

An on-chain message attributed to the attackers identified them as white-hat and asked developers to fix the vulnerability before returning the remainder. The message read: “Please fix the bug first. The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix.”

By Monday, 3,400 BTC had been returned, leaving about 598 BTC still outstanding as Blockstream continued discussions with the actors. Samson Mow, a former Blockstream executive, said the network remained paused while Blockstream and federation members made fixes, resolved a chain split and prepared for a safe restart, and that Liquid wallets and services would continue to be affected during the work.

Federation members are investigating how the withdrawals occurred and working to restore normal network activity. Exchanges have paused or plan to pause LBTC flows while the assessment continues.