Nearly 4,000 Bitcoin—valued at approximately $319 million—moved from the Liquid Network's federation wallet on Sunday, Sept. 6. An on-chain message accompanying the transfer stated: "we are whitehats. contact us on chain." Blockstream and Liquid had not publicly addressed the incident as of 3 p.m. EDT.
On-chain researcher Ergo BTC identified two linked Bitcoin transactions related to the outflow. A large Liquid peg-out moved roughly 4,000 BTC from a pool that previously held about 4,200 BTC. A subsequent transaction spent approximately 3,998.5 BTC and carried the "whitehats" message.
Blockstream's Liquid explorer confirmed the sharp reduction in federation holdings: just 207.275 BTC remaining. The federation wallet had consistently held roughly 4,200 BTC for months.
The scale of the move is notable because Liquid's peg-out system is engineered to prevent direct Bitcoin withdrawals from the sidechain. The standard process requires LBTC to be destroyed on Liquid before federation functionaries process the corresponding Bitcoin withdrawal. Access to mainchain funds relies on an 11-of-15 federation multisignature, and the Peg-out Authorization Key system is designed to restrict payments exclusively to approved member wallets. The precise mechanism behind this transfer remains unconfirmed.
Three possibilities have emerged: a compromised whitelisted wallet, an abuse of Liquid's security mechanisms, or a coordinated extraction to secure funds after discovering a vulnerability. None have been confirmed by Liquid or Blockstream.
The transferred Bitcoin sits concentrated on the Bitcoin blockchain with no mixing evident as of publication.
The "whitehat" message demands skepticism. Without official confirmation from Blockstream or Liquid—or blockchain evidence of the funds' intended use—treating the claim at face value is premature. The identity of the parties behind the transfer remains unknown.
Blockstream's next move is critical: an official statement explaining how 4,000 BTC departed a supposedly secure federation wallet, or a response to the on-chain message that opened this channel.
