Don't want to trade it yourself?
Our desk runs DEX portfolios on profit share.
Currencies39038
Market Cap$ 2.78T-0.46%
24h Spot Volume$ 32.03B+4.86%
DominanceBTC57.15%-0.27%ETH10.89%+0.07%
ETH Gas0.04 Gwei
Market<a href="https://xpertsstudio.com/bitcoin-crash-vitalik-buterin-opposing-it-with-90-net/” title=”Bitcoin Crash? Vitalik Buterin Opposing It with 90% Net”>BitcoinWhite Hat Hacker
Sep 7, 2026
2min read
bySarayu Krishna
forTheNewsCrypto
Liquid Network confirmed a security incident after roughly 4,000 BTC (~$320 million) was withdrawn from its federation wallet via the SideSwap PAK; Liquid says the authorization key wasn’t compromised, it disabled bridge nodes, paused the sidechain and exchanges halted LBTC deposits and withdrawals, with about 3,998.5 BTC still unmoved. The attacker, claiming to be a white‑hat, communicated with Blockstream via OP_RETURN and PGP and offered to return funds only after a vulnerability patch and full node updates, underscoring security risks for Bitcoin sidechain infrastructure and creating short-term uncertainty for crypto market confidence and adoption.
See what traders are focused on
- 4,000 BTC was withdrawn from Liquid’s Federation wallet via the SideSwap PAK, while Liquid said the authorisation key itself was not compromised.
- Liquid disabled bridge nodes and paused the sidechain, while exchanges were notified to halt LBTC deposits and withdrawals as the investigation continues.
Liquid Network confirmed a security incident after purported white-hat hackers withdrew about 4,000 Bitcoin, worth around $320 million, from the Liquid Federation wallet. The withdrawal was executed, though Liquid confirmed the key itself was not compromised, nor were any others
The federation wallet held more than 4,200 BTC before the withdrawal. Bridge nodes were immediately disabled, and the Liquid sidechain was paused, effectively freezing the network until the issue is resolved. Exchanges were notified and moved to pause LBTC deposits and withdrawals.
Moreover, other assets on the network, including USDT, DePix, and RWAs, remain unaffected.
The Negotiation Nobody Expected
After consolidating the funds, the attacker left an on-chain message that changed the entire tone of the incident. It stated that they are white hats and to contact them on-chain.
What followed was an unusual public back-and-forth between Blockstream and the hacker, conducted entirely through OP_RETURN messages and PGP-encrypted notes. This was visible to anyone watching the chain.
At 11:30 AM PDT, the hacker made initial contact. Blockstream responded at 12:31 PM. By 6:49 PM, Blockstream sent a PGP-signed encrypted message. At 7:20 PM, the hacker responded, asking whether it was acceptable to return most of the funds to a specified address.
Then, at 8:27 PM, came the critical message. The hacker asked Blockstream to fix the vulnerability first, warning that the chain remained at risk under the latest commit and that every node needed to be patched before the funds would be safely returned. PGP-encrypted technical details were shared directly with Blockstream.
Blockstream confirmed receipt at 8:30 PM. As of 9:12 PM PDT, approximately 3,998.5 BTC remained unmoved with no further messages from either side. Additionally, the PGP signature matched the key published on Blockstream’s official website, adding credibility to the white-hat claim.
What This Means for the Market?
A $320 million withdrawal from a Bitcoin sidechain, even one that appears to be moving toward resolution. The immediate market impact is uncertainty around Liquid Network’s security architecture and the broader confidence in Bitcoin sidechain infrastructure.
The hacker’s willingness to communicate, share technical vulnerability details, and commit to returning funds is an unusual and relatively positive signal. But until the patch is confirmed, every node is updated, and the funds are returned, the situation remains open.
PUMP Is Compressing Hard: At a Level That Could Go Either Way
Source: cryptorank.io