A single peg-out moved roughly 4,200 bitcoin off Blockstream's Liquid Network on Sept. 6, prompting a network pause and exchange suspensions of LBTC while the operator works to contact the purported white-hat movers.
Back
Liquid Network pauses after purported white-hats drain $320M
Blockstream paused Liquid Network on Sept. 6 after roughly 4,200 bitcoin, worth about $320 million, left the sidechain in a single peg-out.
The transaction carried an OP_RETURN message identifying the movers as "white hats" and inviting contact on-chain, according to the on-chain data. Blockstream's documentation describes the whitelisted destination addresses as "a failsafe to ensure that the federation always remains in full control of the BTC held by the Liquid Network."
The first transfer cleared at 14:06 UTC, releasing 3,996 coins — about 95 percent of the network's holdings — to an address never used before. Four hours later the funds moved again, with the sender paying 269 satoshis, roughly 21 cents, and attaching the message. Because peg-outs destroy the matching L-BTC tokens inside the network, the reserve and token supply shrank together, leaving the peg intact with 0.22 coins to spare.
The scale ranks among the largest security events in the Bitcoin ecosystem's history. Exchanges suspended LBTC deposits and withdrawals, freezing liquidity for holders, and the network remains paused while Blockstream works to contact the purported white-hat actors. Whether the bitcoin are returned — and when the federation can resume operations — hinges on that engagement.
The movement raises pointed questions about how authorization was obtained. Liquid runs on a Strong Federation model, in which a consortium of vetted entities manages the bitcoin reserves backing L-BTC. Withdrawals require signatures from at least 11 of 15 designated functionaries plus Peg-out Authorization Keys, or PAKs, built to reduce the risk of compromised functionaries. Peg-outs typically process in batches taking 11 to 35 minutes; this volume moved without apparent interruption.
Self-identifying as a white hat via on-chain message is not unprecedented. Attackers in the Euler Finance exploit of 2023 and the Poly Network hack of 2021 used similar tactics to negotiate the return of funds, often keeping a percentage as a bounty for identifying the vulnerability. Ronin bridge attackers returned $10 million in 2024 under the same playbook.
For holders, the immediate question is whether remaining reserves are safe. Federated sidechains sit between the trustless bitcoin base layer and centralized systems; the model holds only if the federation itself is secure. If 11 of 15 functionaries can be compromised or the PAK system circumvented, the security assumptions underpinning Liquid need re-examination. Bitcoin users who rely on the sidechain for faster transfers, confidential transactions, or Liquid-native assets now face an open question about the network's integrity.
The roughly 3,998.49 coins that have not moved since the second transfer sit at an address anyone can watch. Whoever holds them asked to be contacted. Blockstream has not answered publicly.
This article is for informational purposes only and does not constitute investment advice.
