Blockstream’s Liquid Loses 4,000 Bitcoin to a ‘White Hat’

THE LIQUID NETWORK — On the morning of September 6, one transaction drained almost all of the bitcoin held on Blockstream’s Liquid Network: nearly 4,000 coins, worth about $320 million, and by most counts around 95% of everything the sidechain custodies. Nothing about the transaction looked broken. The signatures were valid. The federation that runs Liquid had, through its ordinary process, authorized the move itself.

This was not a stolen key or a phishing lure. It was a flaw in the software the federation uses to sign peg-outs — the step that releases bitcoin locked on the main chain back to its owner. The code approved a withdrawal it should have refused, and the network’s own signers waved it through.

What Liquid is, and why that matters

Liquid is a federated sidechain Blockstream launched in 2018. You lock bitcoin on the main chain and receive an equal amount of L-BTC on Liquid, where blocks are faster, transaction amounts can be kept confidential, and new assets can be issued. To move value back, a federation — a set of functionaries running signing hardware — collectively authorizes a peg-out.

That design buys speed and privacy. It also parks the coins behind a multi-party wallet instead of a user’s own keys. And that is the trade the base chain refuses to make. Bitcoin’s whole proposition is that no committee stands between a holder and their money. A sidechain reintroduces the committee, and on September 6 the committee’s software failed.

A hack that reads like a negotiation

What followed was unusual. The mover attached a message to a bitcoin transaction announcing himself: “we are whitehats.” Blockstream took the olive branch. Rather than chase an anonymous adversary, the company opened a public negotiation, and the two sides spent the weekend arranging a return, one small transaction at a time.

As of writing, the bulk of the funds had not moved again. People close to the talks describe a condition: the return is contingent on the underlying bug being patched, so the same door cannot be reopened the moment the coins are back. Blockstream paused the network while it works, leaving L-BTC holders waiting on a restart and the resumption of peg-outs.

The base layer never noticed. Not a satoshi on Bitcoin’s main chain moved.

Be precise about what broke. Bitcoin itself was untouched. No consensus rule failed, no miner was fooled, no coin on the main chain changed hands without a valid signature from its owner. The failure lived entirely inside a system built on top of bitcoin to make it do more.

The recurring lesson of bridges

This is not the first time a bridge between chains has been the weak link, and it will not be the last. Cross-chain bridges and federated sidechains concentrate value behind a small number of signers and a large amount of code. Both are attack surface. When either fails the losses tend toward total, because there is no base-layer rule to fall back on — only the honesty and competence of the operators.

Liquid’s defenders will note the network is niche, the federation acted in the open, and a cooperative white hat is the best version of a bad day. All true. But the episode is a clean illustration of a principle worth repeating: convenience layers are useful precisely because they relax bitcoin’s constraints, and every constraint they relax is a risk they take on.

For a holder, the practical takeaway is old and unglamorous. Coins on the base chain, in a wallet you control, carried no exposure to this at all. Coins handed to a faster, more featureful layer carried the risk of that layer’s worst day — and this weekend was it.

Why it matters: every layer built on top of bitcoin to make it faster or more private reintroduces the trusted party the base chain was designed to remove — and inherits the risk that party fails.

Reported from public sources and on-chain records; figures reflect reporting as of September 7, 2026 and may change as the return proceeds. Informational only — not financial advice.