Nearly 4,000 Bitcoin Worth $319 Million Drained From Blockstream's Liquid Network Federation Wallet

Security Breach Uncovered by Whitehat Hackers

On Sunday, September 6, 2026, approximately 4,000 bitcoin—valued at around $319 million—were moved out of the Liquid Network's federation wallet, according to multiple reports. The funds were reportedly transferred from Blockstream's Liquid Peg, a key component of the Liquid sidechain used for Bitcoin trading and transfers.

The movement occurred through a transaction identified by blockchain analysts, who noted the transfer originated from a known federation wallet address. Blockstream, the company behind the Liquid Network, has not yet issued an official statement regarding the incident. However, a group identifying themselves as We Are Whitehatsclaimed responsibility in a message circulated on cryptocurrency forums, stating they had identified and neutralized a critical vulnerability in the network's infrastructure.

The group We Are Whitehatsrevealed they discovered a severe security flaw that could have allowed unauthorized access to federation funds. Rather than exploiting the vulnerability for personal gain, they moved the bitcoin to prevent potential theft by malicious actors. Their actions were accompanied by a detailed technical explanation of how the exploit worked, aiming to alert the community and prompt a swift response from developers.

What Happens Next to the Recovered Funds?

According to their disclosure, the vulnerability stemmed from insufficient validation in the federation's multi-signature transaction approval process. By manipulating transaction inputs, an attacker could have potentially drained additional funds. The whitehats emphasized that their intervention was a preventive measure, not a theft, and they have since been working with Blockstream to secure the network.

The whereabouts of the 4,000 bitcoin remain unclear. The whitehats stated they would return the funds to the Liquid Network's secure custody after a vulnerability patch is deployed. However, community members have raised concerns about the lack of a transparent recovery mechanism and whether the network can fully verify the group's intentions.

Blockchain experts are divided on the ethical implications of the whitehats' actions. While their intervention prevented a larger breach, operating outside official channels raises questions about accountability and governance in decentralized systems. The incident highlights ongoing tensions between security research and protocol integrity.

Frequently Asked Questions

How did the whitehats discover the vulnerability? They analyzed transaction patterns and identified weaknesses in the federation's signature validation process, allowing them to simulate an unauthorized fund transfer.

Will the stolen bitcoin be returned? The whitehats claim they will return the funds once Blockstream confirms the network is secure, though no formal mechanism exists to guarantee this.

Has Blockstream responded officially? As of now, Blockstream has not released a public statement, but internal teams are reportedly working on a security update.