Attackers Withdraw $319 Million in BTC from Liquid Network, Leave On‑Chain Note

On Sunday, a single transaction moved roughly 4,000 BTC (about $319 million) from Blockstream’s Liquid sidechain to a previously unused address. The fee for the move was 269 satoshis, roughly $0.21. The transaction included an OP_RETURN field containing the text “we are whitehats. contact us on chain”.

Transaction details

The first peg‑out at 14:06 UTC transferred 3,996 BTC, representing about 95 % of the Liquid network’s total BTC holdings. Four hours later the sender returned 0.00001 BTC to a Liquid address, while the remaining 3,998.49 BTC have not moved since.

Impact on Liquid’s collateralisation

Liquid’s peg remains intact. After the withdrawal, the network’s reserve still covers the outstanding L‑BTC tokens down to the fourth decimal place, with a surplus of 0.22 BTC. No L‑BTC holder is short a satoshi, disproving insolvency concerns.

Governance and safeguards

Liquid’s peg‑out process requires the destruction of the corresponding L‑BTC tokens inside the sidechain. Only members of the federation—15 companies holding the signing keys—can authorize a burn, and at least 11 signatures are needed. The destination address used in the transaction was whitelisted as a safeguard, but Blockstream has not commented on why a new address was chosen.

Comparison to previous bridge incidents

Similar behaviour was observed in the 2024 Ronin bridge attack, where the perpetrators returned part of the stolen funds and posted a message on‑chain. In the Liquid case, the funds remain idle, and the sender’s request for contact has not been answered.