Liquid Network confirms $320 million BTC withdrawn in unauthorized peg-out

Unauthorized peg-out and on-chain messages

Liquid stated that so-called “white-hat hackers” carried out the withdrawal. The group behind the transfer left an on-chain OP_RETURN message: “we are whitehats. contact us on chain.” Blockstream, a key participant in the Liquid Federation, is attempting to reach out to the group using a signed message published on-chain.

Blockchain investigator ErgoBTC pinpointed the specific transaction, confirming that about 3,996 BTC was moved to the address “bc1qgs…c6wt7p” and recorded in Bitcoin block 965,783 at 14:28:56 UTC on September 6.

Liquid further explained that the transaction was authorized with SideSwap’s peg-out authorization key (PAK). However, the SideSwap PAK itself was not compromised, suggesting another part of the control chain may have failed. This detail remains central to understanding what occurred.

The distinction that the SideSwap PAK was used, yet not breached, is essential for clarifying the breach, as it raises questions about what vulnerabilities were exploited within the federation’s operational path.

How peg-outs and security mechanisms function

The Liquid Network secures assets via a two-way peg between Bitcoin and its sidechain. According to technical documentation, users deposit BTC to receive Liquid Bitcoin (LBTC) and redeem LBTC to retrieve their Bitcoin. Outflows, or peg-outs, require authorization through a Peg-out Authorization Key, which is intended to prevent even compromised functionaries from diverting user funds.

Liquid’s system designates that more than two-thirds of block signers and watchmen must approve transactions involving the federation’s Bitcoin holdings, aiming to ensure strong protection against unauthorized withdrawals.

White hat claims and market impact

The actors described themselves as white hats, but there is no independent confirmation of their intentions. Industry observers point out that such claims should be treated with caution until there is evidence of returned funds. For instance, in a previous case involving TAC protocol, attackers returned hacked funds only after receiving a portion as a “reward.”

Currently, the withdrawn BTC remains under control of the parties behind the transfer, and no signs indicate that the funds have been moved to exchanges. Therefore, direct selling pressure on the market has not been confirmed.

Until the almost 4,000 BTC is returned, the white-hat status remains only a claim, and the ultimate outcome is uncertain.

Federated bridges, trust, and industry implications

Recent findings from TRM Labs show that infrastructure and operational vulnerabilities contributed to only about 15% of crypto incidents in the first half of 2026, but they were responsible for 76% of financial losses. This contrast demonstrates that weaknesses in custody systems and bridge protocols can outweigh multiple smaller exploits in monetary impact.

A July 2026 study by Heritage Falodun and Samson Ojo found that less than 1% of all BTC in circulation is integrated into DeFi, compared to around 30% for Ethereum. The researchers argue that concerns about institutional trust and underlying infrastructure limit deeper adoption of Bitcoin-based DeFi.

Blockstream’s latest roadmap puts particular focus on reducing the sector’s reliance on trust-based models. The company is currently developing a BitVM 1-of-n bridge model, aiming to minimize risks like those seen with traditional federated designs.

Given that sudden protocol changes, technological exploits, or even unexpected listings can impact the market within seconds, professional investors now prefer all-in-one platforms that help them avoid loss of time or money. Smart traders are increasingly turning to privacy-focused solutions like CryptoAppsy, which provide consolidated real-time charts, coin-specific news, macroeconomic data, and portfolio tracking in a single interface, eliminating the need to switch between various applications or create new accounts.

Whether or not the involved parties return the withdrawn BTC has yet to be determined. The situation remains a pivotal test for security practices across federated bridges and the confidence that Bitcoin users place in such architectures.