Liquid lost 95 percent of its Bitcoin to self-declared white hats

Roughly 4,000 BTC, worth about $320 million, left the federation wallet backing Blockstream's Liquid Network on Sunday. The wallet held around 4,200 BTC before the withdrawal, so whoever moved the funds took approximately 95 percent of everything backing L-BTC.

They then left a message asking to be treated as researchers.

The negotiation happened on the blockchain

Embedded in a Bitcoin transaction, the people responsible identified themselves as whitehats and asked Blockstream to make contact. Blockstream replied on-chain with details for its security team, and Liquid says both sides have since moved to encrypted channels.

Their stated condition for returning the funds is a patch. "Please fix the bug first," the on-chain message read. "The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix."

They said they would return "most" of the Bitcoin. That word is carrying an enormous amount of weight in a sentence about $320 million, and nobody outside the group knows what fraction it covers.

Nobody has explained the peg-out yet

Liquid disabled its bridge nodes while federation members investigate, and asked exchanges to suspend L-BTC deposits and withdrawals.

What it has said about the mechanism raises more questions than it answers. The Bitcoin was withdrawn through SideSwap using its Peg-out Authorization Key, but Liquid says neither SideSwap's key nor any other PAK appears to have been compromised. Peg-out Authorization Keys let federation functionaries recognise destinations approved to receive Bitcoin coming back out of the sidechain, after which the functionaries collectively release the coins.

So an apparently legitimate peg-out emptied almost the entire wallet without any of the keys governing peg-outs being stolen. That gap is the whole investigation.

White hat is not a status you assign yourself

The description has not been well received. Ledger chief technology officer Charles Guillemet was blunt about the sequence, arguing that genuine researchers disclose a flaw before moving hundreds of millions in collateral rather than afterwards.

The objection is about ordering, and it is a fair one. A disclosure is a message. This was a transaction, followed by a message. Everything that separates security research from theft, consent, coordination, and the other side's option to say no, happened only after the coins had already moved.

There is also no mechanism to hold anyone to the promise. The funds sit on Bitcoin's base layer in addresses the group controls. The only pressure available to Blockstream is that the people holding them appear to want the reputational benefit of giving them back.

Adding Bitcoin to something does not give it Bitcoin's security

This is the structural point, and it reaches well beyond Liquid. The Bitcoin network itself was untouched. Other assets issued on Liquid, including stablecoins, do not appear to have been directly affected.

Liquid is a federated sidechain. A defined group of members collectively holds the Bitcoin backing L-BTC and collectively decides when to release it. That is a different trust model from Bitcoin's own, where miners and the wider network secure the funds and no committee is in a position to move them. The peg is only ever as strong as the federation's software and its key handling, and this week the software was the weaker of the two.

For anyone who held L-BTC, none of the framing changes their position. The coins backing their holdings are somewhere else, controlled by parties they did not choose, subject to a promise with nothing enforcing it. Whether all 4,000 BTC come home will settle how generous anyone feels about the word whitehats.

One sanity check on the headline figure while that plays out: 4,000 coins valued at roughly $320 million implies a Bitcoin price near $80,000, which is the arithmetic the number rests on. If the price moves, so does the size of the story.