Hackers Drain $320M in Bitcoin From Liquid Network Federation Wallet

When an unknown collective siphons nearly the entire treasury of a major financial infrastructure project, standard operating procedure usually involves immediate panic and law enforcement involvement. In the case of the Liquid Network, however, a $320 million extraction has morphed into an unprecedented high-stakes digital negotiation. The breach, which took place in September 2026, targeted the federation wallet backing the Bitcoin sidechain developed by Blockstream. According to The Register, attackers managed to withdraw roughly 4,000 BTC out of the 4,200 BTC stored in the wallet, representing a staggering 95 percent of its total holdings. The incident immediately paralyzed the network, forcing operators to pull emergency levers to contain the blast radius across institutional partners.

How did the Liquid Network exploit unfold and who is affected?

The Liquid Network exploit occurred when unauthorized actors drained 4,000 BTC from the federation wallet backing Blockstream's Bitcoin sidechain, directly impacting digital asset exchanges and financial institutions that rely on the layer-2 network. Liquid operators confirmed via social media on Sunday that the funds were removed by actors they cautiously described as purported white-hat hackers. In response to the breach, the network immediately disabled its bridge nodes while federation members scrambled to investigate the vulnerability. Furthermore, digital asset exchanges were urged to suspend all L-BTC deposits and withdrawals to prevent cascading losses across the broader crypto economy. The swift operational shutdown prevented further unauthorized token generation, but left millions in institutional liquidity temporarily frozen.

What do the hackers claim about their motives and stolen funds?

The actors behind the 4,000 BTC withdrawal claim they are white-hat hackers who intend to return most of the funds once a critical code vulnerability is patched. Embedding their communication directly within a Bitcoin transaction, the anonymous perpetrators asked Blockstream security personnel to establish contact. Blockstream responded on-chain with official security team credentials, prompting both parties to move their ongoing negotiations to encrypted communication channels. The alleged white-hats stated that their primary goal was forcing a network-wide security upgrade rather than executing a permanent theft. They asserted that the underlying codebase contained a severe risk at the latest commit, leaving them little choice but to seize the funds preemptively to protect users from malicious actors.

• Attackers drained approximately 4,000 BTC from the Liquid Network federation wallet.
• The stolen assets represented roughly 95 percent of the wallet's total 4,200 BTC holdings.
• Liquid disabled bridge nodes and asked exchanges to halt L-BTC transactions.
• The hackers communicated via an on-chain message demanding patches before returning funds.

Whether this incident represents a genuine white-hat intervention or a sophisticated extortion attempt dressed in ethical garb remains a subject of intense debate among security researchers. Traditional financial regulators and cybersecurity experts view armed-takeover style asset seizures with extreme skepticism, regardless of subsequent promises of restitution.

"Please fix the bug first. The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money…" — On-chain message from the alleged hackers to Blockstream

What to watch next

As the Liquid Network incident unfolds, industry stakeholders and security professionals should monitor several key developments to gauge the true nature of the breach. The speed and transparency of the engineering response will dictate confidence in federated sidechain architectures moving forward.

• Verification of the cryptographic patches released by Blockstream to secure vulnerable node commits.
• Official confirmation from Liquid regarding the successful and complete return of the 4,000 BTC.
• Potential regulatory fallout and compliance scrutiny facing exchanges that integrated the affected sidechain.