Liquid Network lost 4,000 bitcoins, about $320 million, and then told the world the people who took it might be the good guys. That is the story so far.
The breach hit on September 6. Blockstream's Liquid Network, a Bitcoin sidechain used by several cryptocurrency exchanges to move funds faster, saw its federation wallet drained from roughly 4,200 BTC down to about 200 BTC in a matter of hours. The network halted new transactions. Exchanges suspended L-BTC deposits and withdrawals. Users woke up to frozen balances and a public post calling the attackers "purported white-hat hackers."
That phrase did land. Online, the temperature split fast. One camp treated the white-hat label as a negotiating position, not a moral stance. Another camp treated it as a story the network needed to tell to keep panic from spreading. A third camp stopped asking questions and just watched the blockchain to see if the coins would come back.
Liquid Network said the funds left through SideSwap, a settlement platform authorized to handle redemptions. The company added that the keys behind that process were not compromised. Instead, the problem sat upstream, in Elements, the open-source software that powers the sidechain. A bug there allowed new L-BTC tokens to be created without matching bitcoin reserves. Those tokens were then pegged out for real BTC. No multisig keys were stolen. The plumbing failed.
By Monday, after Blockstream patched bridge nodes, about 3,400 of the 4,000 BTC had been returned to the federation wallet. Roughly 598.5 BTC, worth about $47 million, remained outside. That is the part people keep circling. If this was a white-hat disclosure, why keep nearly $50 million? If it was a theft, why return most of it?
The answer matters because Liquid is not some obscure experiment. It launched in 2018. Exchanges rely on it. Traders use it. When a network like this breaks, the damage is serious. It is trust. And trust is the only thing keeping a lot of this industry from sliding back into 2022.
This breach did not happen in a vacuum. In July, Coldcard, a bitcoin hardware wallet company, saw a firmware bug that let attackers brute-force wallet seeds. The estimated loss was $130 million. Earlier this year, a Crypto.com lending platform also suffered a hack. The pattern is getting hard to ignore. Compromised keys and software bugs now cause more crypto losses than smart contract exploits. The same attack keeps working.
DeFi has lost about $1.3 billion to hacks in 2026. August alone saw 50 significant incidents, a 67 percent jump from July. The numbers are not abstract. They are the temperature of a room where everyone is pretending the fire alarm is a suggestion.
Liquid Network's response was fast. Notify exchanges. Suspend activity. Patch the bug. Ask the hackers to talk. That is the right sequence. But the white-hat framing introduced a new problem. It turned a security incident into a public relations one. Now every statement has to walk a line between accountability and damage control.
Some voices online treated the returned 3,400 BTC as proof of good faith. Others treated it as a partial refund after a failed exit. A quieter group just watched the chain and waited to see if the remaining 598.5 BTC would move. That silence is its own kind of data. It says people are done arguing and started tracking.
Blockstream has said it is trying to contact the actors behind the withdrawal. An on-chain message was left. No independent party has verified the white-hat claim. That is the unresolved part. Until someone can show that the flaw was reported responsibly, or that a bounty was negotiated in advance, the label stays unproven.
What is proven is the loss. 4,000 bitcoins left the federation wallet. $320 million vanished in hours. Exchanges froze activity. Users faced delays. The network paused. Those are the facts. Everything else is a story people are telling to make sense of it.
The crypto industry keeps asking banks and regulators to treat digital assets as real infrastructure. Then incidents like this happen, and the answer sounds like "we think they might be the good guys." That does not inspire confidence. It inspires caution.
Liquid Network will restart. The bug will be patched. The remaining coins may or may not come back. The exchanges will lift suspensions. Traders will move on. But the question stays. If the plumbing can fail this hard on a network this old, what else is waiting to break?
And if the people who broke it get to call themselves white hats, who gets to call them anything else?
More on: News