Blockstream announced that approximately 4,000 BTC, representing 95% of the reserve backing its L-BTC token, had been withdrawn from its federated wallet. This sum of nearly $320 million, claimed by its perpetrators as a "white hat" operation, is far from being universally accepted as legitimate.
What happened
On Sunday, September 6, late in the morning (New York time), Liquid Network posted a message on X announcing that a transaction had depleted almost the entire reserve of bitcoins backing its L-BTC token. Specifically, the federated wallet—the one holding the BTC deposited in exchange for the L-BTC circulating on the sidechain—dropped from approximately 4,200 BTC to just over 200 BTC. Between 3,996 and just over 4,000 bitcoins were thus removed from the reserve, according to various sources.
Liquid immediately suspended transactions on its network and asked exchanges to block L-BTC deposits and withdrawals while they assessed the extent of the breach. According to the network, the funds were withdrawn via SideSwap, a settlement platform authorized to process withdrawals on the network—the key used in the process was reportedly not compromised. An on-chain message (in OP_RETURN format) attributed to the perpetrators of the withdrawal stated: "We are white hats, contact us on-chain."
For now, the bulk of the funds has not been dispersed or laundered, which gives rise to two possible interpretations: that of a preventive rescue with a view to a negotiated restitution, or that of an exploit followed by an attempt at bargaining.
How Liquid works — and where the system broke down
Liquid is a Bitcoin sidechain, developed with technical support from Blockstream since 2018. It enables faster and more confidential transactions than the Bitcoin chain itself, as well as the issuance of digital assets (stablecoins, tokenized securities, etc.). Its operation is based on a peg principle: each L-BTC in circulation must be backed by a real bitcoin, locked in a wallet collectively controlled by a Federation of fifteen entities.
In theory, withdrawing funds from this portfolio requires a qualified majority of eleven out of fifteen signatures, supplemented by authorization keys known as PAKs (peg-out authorization keys). It is precisely this multi-signature consensus mechanism that appears to have been hijacked or exploited—the exact technical details of the vulnerability remain unclear at the time of writing.
A "white hat" who doesn't admit it
The "white hat" label—a hacker who exploits a vulnerability to reveal and fix it, without malicious intent—is far from convincing everyone. Charles Guillemet, Ledger's chief technology officer, has publicly questioned this version: a security researcher typically notifies the affected protocol before moving hundreds of millions of dollars in collateral, not afterward. He compared the incident to the 2022 Ronin Bridge hack, where attackers also unsuccessfully attempted to pose as benevolent actors after the fact.
Blockstream, for its part, has chosen caution in its communications, avoiding the word "theft" and actively seeking to establish contact with the perpetrators of the withdrawal via on-chain transactions — a form of remote negotiation, without certainty about its outcome.
Why this episode matters
From a purely technical standpoint, this hack does not compromise the security of the Bitcoin protocol itself. Liquid is a federated sidechain, an ancillary system that relies on trust in a limited group of signatories—a fundamentally different architecture from the decentralized, permissionless consensus of the main chain. This is precisely the crux of the matter: the incident illustrates the price to pay for the trust compromises inherent in any scalability or interoperability solution built "alongside" Bitcoin, rather than on top of it.
The amount involved is far from insignificant. It alone exceeds the total cumulative losses from DeFi hacks for the entire month of August 2026, when one of the sector's trackers recorded approximately $136 to $140 million in losses across some fifty separate incidents, the largest of which—the Tectonic exploit on Cronos—accounted for around $74 million. In a single transaction, the Liquid incident thus more than doubles the monthly total for August and eclipses its largest individual incident by more than four times.
The impact remains limited, however: only the L-BTC peg is directly affected, not other assets issued on Liquid, nor, a fortiori, the Bitcoin network itself. A freeze that would have also affected stablecoins or tokenized assets hosted on the sidechain would have represented a significantly broader risk of contagion for exchanges and market makers that rely on Liquid for their settlements.
A broader context: the dubious trend of "white hat" in retrospect
The Liquid episode is part of a trend observed several times in 2026: attackers siphon funds, then publish an on-chain message claiming benevolent intentions, before waiting for the protocol and public reaction to decide whether or not to return the stolen sums. This scheme is sometimes genuine: a researcher moves funds to a secure address to prevent a second attacker from exploiting the same vulnerability, before negotiating a reward (bug bounty) and returning most of the funds. But it also increasingly serves as a cover for admitted thefts, the deliberate ambiguity allowing attackers to buy time with the authorities and the victims.
What's Next ?
Currently, several questions remain open:
- The return of funds Blockstream is attempting to negotiate via on-chain messages, but there is no guarantee that an agreement will be reached, nor on the timetable.
- The exact origin of the fault Is this a flaw in the Federation's signature logic, a key compromise, or an abuse of the SideSwap withdrawal procedure? Blockstream has not yet published a detailed post-mortem analysis.
- The network recovery : L-BTC deposits and withdrawals remain suspended on partner platforms, which de facto freezes part of the economic activity built on Liquid (settlements, stablecoins, tokenized assets).
- The consequences for trust in federated sidechains Beyond Liquid, this episode reignites the debate on the security compromises involved in "federated" architectures, as opposed to solutions that directly inherit the security of the Bitcoin chain, such as the Lightning Network.
One thing is certain: in a market where Bitcoin was moving in a positive direction, and US spot ETFs had just recorded their best week of net inflows of the year, this incident reminds us that the security of the peripheral layers remains the weak link in the ecosystem, even though the Bitcoin protocol itself has, once again, shown no flaws.
This article was written using information available as of September 7, 2026; as the situation is still under investigation, some elements may change.
Learn more about ZoneBitcoin
Subscribe to get the latest posts sent to your email.
