"We Are Whitehats, Contact Us On Chain": 95% of Liquid Network's Bitcoin Reserves Just Vanished in One Transaction

It is Sunday evening in New York, and one of Bitcoin’s oldest infrastructure experiments is fighting for its life. On September 6, a single peg-out transaction moved roughly 4,000 bitcoin — approximately $318–320 million at current prices near $79,700 — out of the federation wallet that backs Liquid Network’s LBTC token. Blockstream’s public proof-of-reserves page now shows a little over 207 BTC left in the treasury, down from more than 4,200 before the transaction. That is roughly 95% of the network’s reserves gone in one coordinated move, executed without any prior disclosure, exploit notice, or — so far — any explanation from the company that built the chain. In the transaction’s data field, the actors left a message: “we are whitehats. contact us on chain.”

The transaction that emptied the treasury

Liquid Network is a Bitcoin sidechain operated by a “strong federation”: a consortium of vetted companies that collectively guard the mainchain bitcoin backing L-BTC, a token used for faster, confidential transfers and for issuing assets such as USDT. The withdrawal, flagged by on-chain trackers on Sunday morning, swept 4,019.4 BTC from the federation reserve address in a peg-out that used the SideSwap Peg-out Authorization Key (PAK) — a cryptographic control designed to restrict withdrawals to authorized Bitcoin addresses. The funds landed in an address ending in 6gyqjlte, where they remain concentrated; there is no evidence of rapid dispersion or laundering.

The mechanics matter because Liquid is supposed to be a fortress. Fifteen functionaries — exchanges and infrastructure firms — run the network, and an 11-of-15 multisig quorum must sign any movement of the underlying bitcoin. On top of that, PAKs add a second layer precisely to protect against compromised functionaries. Liquid acknowledged on Sunday that the withdrawal passed through SideSwap’s PAK, while insisting that neither that key nor any other was compromised. So how did roughly $320 million walk out the door? Investigators’ leading hypothesis is an inflation bug on the L-BTC sidechain itself: that the actors minted more than 4,000 LBTC that never existed, then redeemed them against the federation’s real bitcoin. Because the minted tokens appeared valid under the network’s consensus rules, the functionaries’ hardware security modules signed the withdrawal as if it were legitimate.

“We are whitehats”: a negotiation conducted on-chain

What followed is a rare, public negotiation written directly into Bitcoin’s ledger. The first OP_RETURN message read “we are whitehats. contact us on chain.” A small mainnet transaction then carried a reply — presumably from Blockstream, though unconfirmed — reading “Please contact security@blockstream.com.” The actors responded in a subsequent spend from the address holding the 4,000 BTC: “Please contact us on Signal @m671aw.70.” At the time of writing, no agreement has been announced and no funds have moved back.

The “whitehat” framing is doing heavy lifting. Self-identifying as an ethical hacker on-chain is not unprecedented — the Euler Finance exploiters in 2023 and the Poly Network hackers in 2021 both used similar playbooks, negotiated, and returned the bulk of the funds in exchange for a bounty. But Charles Guillemet, chief technology officer of hardware wallet maker Ledger, publicly challenged the claim, noting that legitimate security researchers normally disclose a vulnerability before moving hundreds of millions of dollars of other people’s collateral. The funds’ concentration is the one fact that cuts in the actors’ favor: 4,000 BTC is far too traceable to launder quietly, and the address is now under global surveillance.

The sidechain is paused, LBTC is frozen

Liquid confirmed the incident in a post on X: “We are aware of a security incident on @Liquid_BTC.” Bridge nodes were disabled, exchanges were notified and suspended or began suspending LBTC deposits and withdrawals, and the network said it had “effectively… paused” the sidechain until the issue is resolved. Liquid stressed that other assets issued on the chain — USDT, DePix and tokenized real-world assets — were unaffected, and that on-chain analysis shows the corresponding LBTC was burned during the withdrawal, meaning the remaining LBTC supply still has matching bitcoin behind it on a token-for-token basis. That distinction is cold comfort for holders, though: with redemptions frozen and the treasury down to 207 BTC, LBTC is currently not redeemable at all. JAN3 CEO Samson Mow said his firm’s Aqua wallet — which relies on Liquid — had its Liquid features disrupted, and industry wallets built on the network are bracing for a long outage.

What it means for Bitcoin holders

The immediate market impact was muted — Bitcoin barely blinked, and prediction markets still give it better than a 99% chance of closing Monday above $74,000. Markets are treating this as an isolated infrastructure failure, not a systemic event. But the incident lands with uncomfortable timing for the industry’s custody narrative in Washington. Just days before the Senate’s September 15 cloture vote on the CLARITY Act, Senator Cynthia Lummis has been hammering one message: exchanges collapse “with no custody rules,” and the bill’s qualified-custodian and segregated-funds requirements would ensure the next collapse doesn’t wipe out users. Liquid Network was not an exchange and is not covered by the bill’s provisions — but it was a trusted third party holding other people’s bitcoin, and it just proved that even a 15-key federation with hardware security modules can be emptied in a single transaction. The episode is a reminder, in real time, of why the custody question keeps coming back: every layer between a user and their keys is a risk layer, and no multisig arrangement is a substitute for verification.

The questions that matter now are brutally simple. Was this a rescue or a heist? Will the roughly 4,000 BTC come back — and at what price, in the form of a “finder’s fee”? When — and with what remaining reserves — will Liquid restart redemptions? And can a federation whose security model was just bypassed ever fully restore user trust? Blockstream, which has not issued a formal statement, holds the first answers. For everyone holding LBTC tonight, the wait is the point: their bitcoin is safe on the mainchain, but the token that represents it is frozen — and that is a risk no whitehat message can undo.

Data points are indicative and drawn from public sources cited above; this article is not investment advice.