GoKawiilAttackers empty 95% of Liquid Network's federation wallet, claim white-hat intent
Blockstream's Liquid Bitcoin sidechain confirmed that hackers withdrew about 4,000 BTC—roughly 95% of its federation wallet, worth roughly $320 million—on September 6. The attackers embedded an on-chain message calling themselves 'whitehats,' asking Liquid to patch the vulnerability before they return the funds, and Liquid has since suspended transactions while shifting communication to an encrypted channel.
GoKawiil's interpretation of the reporting above, not reported fact.
The incident exposes a structural weakness in Liquid's federated multisig model, which relies on 11-of-15 rotating signers rather than proof-of-work mining, raising questions about the security assumptions behind federated sidechains. Whether or not the funds are returned, the episode highlights how much trust users place in centralized custodial arrangements even within Bitcoin's ecosystem, and could shake confidence in similar sidechain designs.
- Roughly 4,000 BTC (~$320M), about 95% of Liquid's federation wallet, was withdrawn in the exploit.
- Attackers claim to be white-hat hackers and say they'll return funds once the underlying bug is patched.
- Liquid has suspended transactions and moved to encrypted communications while investigating the breach.
Ledger Nano X Hardware Wallet — When exchange and sidechain wallets get drained, self-custody looks a lot more appealing. The Ledger Nano X keeps your private keys on a dedicated offline device with Bluetooth support and a companion app for managing Bitcoin and other coins from your phone or desktop.
See Ledger Nano X Hardware Wallet on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: tomshardware.com — Etiido Uko, 2026-09-08
Published there as: “Hackers drain $320 million in Bitcoin from Liquid Network, emptying roughly 95% of federation wallet — attackers claim they’re the ‘good guys’ and will return funds after the vulnerability is fixed”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.