Liquid Network lost nearly 4,000 BTC, Blockstream seeks contact with hackers

Unauthorized peg-out and hacker communication

The transfer was executed through a process known as a peg-out, allowing Bitcoin to move from the Liquid sidechain back to the primary Bitcoin network. Liquid Federation stated that this transaction was not authorized through its usual process.

The party responsible for the withdrawal left an on-chain message using the OP_RETURN function, which read, “we are whitehats. contact us on chain.” This message was included in Bitcoin transaction c103de95817b43f2df635ec6f35ff126ca26a7c6d20570c4b01866b2b3e69a19. Liquid Federation described those behind the event as “purported white-hat hackers” and reported that Blockstream was attempting to establish contact with them via a signed on-chain response.

Blockstream is trying to reach the individuals who removed the funds using a signed message, following a withdrawal conducted outside the regular authorization pathway.

Blockchain analyst ErgoBTC identified the significant payout as transaction 8db751…a7b140, which sent roughly 3,996 BTC to the address bc1qgs…c6wt7p. This was confirmed in Bitcoin block 965,783 at 14:28:56 UTC on September 6. On the Liquid sidechain, Blockstream’s explorer recorded the correlated transaction ce4cae…e988f2, reflecting a 3,996.01834922-LBTC peg-out.

Liquid Federation indicated that the withdrawal used SideSwap’s Peg-out Authorization Key (PAK), yet claimed the key itself was not compromised. This distinction remains essential to understanding the breach.

Mini dictionary: Liquid Network – A Bitcoin sidechain developed by Blockstream, designed to offer faster and more confidential transactions for traders, exchanges, and financial institutions.

Peg-out Authorization Key in focus

Liquid Network uses a two-way peg that allows users to lock BTC to create Liquid Bitcoin (LBTC) on the sidechain. They can later destroy LBTC in exchange for redeeming the locked BTC. Peg-out transactions are safeguarded by a Peg-out Authorization Key, which is intended to prevent compromised functionaries from moving user funds to malicious addresses.

According to project documentation, even if some of the block signers were compromised, the PAK system is meant to block unauthorized transfers. Liquid’s “Strong Federation” structure requires at least two-thirds of block signers to validate blocks and an even higher proportion of watchmen to approve BTC spending.

Liquid Federation stated there were no signs that the key itself was breached. The focus now centers on how the transaction was approved with a valid, uncompromised authorization key.

White hat claims under scrutiny

The individuals responsible described themselves as “white hats,” but no evidence has been provided to support this claim beyond the message left on-chain. Previously, other incidents, such as the hack on TAC protocol, were only recognized as white-hat operations after the attacker returned most of the funds.

As long as the almost 4,000 BTC remain unrecovered, the “white hat” status asserted by the actors should be considered a claim rather than a conclusion.

There is currently no indication that the funds have reached exchanges or been sold, so any immediate market impact is uncertain. On-chain movement does not guarantee selling pressure unless the assets are deposited for trading.

Confidence in federated bridges at stake

A report from TRM Labs covering crypto hacks in early 2026 found that issues with infrastructure and operations caused only about 15% of incidents, but accounted for an estimated 76% of total monetary losses. This shows that breaches affecting custody and bridges often inflict much greater damage than smaller exploits.

Research by Heritage Falodun and Samson Ojo in July 2026 highlighted that only 0.8% of circulating Bitcoin is used in decentralized finance, compared to about 30% for Ethereum. The study cited trust in infrastructure as a leading reason why capital remains on the Bitcoin base layer rather than being integrated into DeFi activities.

Blockstream, the firm leading Liquid’s development, published a roadmap in May addressing the need to minimize reliance on trusted third parties in bridge schemes. One ongoing initiative includes the development of the BitVM 1-of-n bridge, designed to enhance trustlessness and security. If federated bridge models continue to see incidents like this, such innovations may become increasingly critical.

It is still unclear how the hackers will respond to Blockstream and whether the stolen BTC will be returned, left dormant, or transferred to exchanges. The episode now stands as a major test not only of Liquid’s security but also of the broad confidence that Bitcoin users place in federated bridging solutions.