Blockstream Hackers Turn Bitcoin Into a Wild Onchain Message Board

On September 6, an exploit targeted Blockstream’s Liquid Network, draining almost 4,000 BTC from the side‑chain’s reserves. The attackers identified themselves as “white hats” and used Bitcoin’s OP_RETURN field to post messages directly on the blockchain, turning the public ledger into a noisy discussion board.

On‑chain dialogue between attackers and Blockstream

The initial transaction included the note “we are whitehats. contact us on chain.” Blockstream responded with a request to email [email protected] and later posted an encrypted, PGP‑signed message that could not be read. The attackers replied, indicating they would return most of the funds to a specified address.

Partial restitution

At 16:09 UTC on the same day, the group sent 3,400 BTC back to the Liquid federation wallet, retaining 598.49 BTC. The remaining funds have not been returned, and the reason for keeping them is unclear.

Blockchain spam and scams

Following the exploit, a flood of low‑value (“dust”) transactions filled the blockchain. Many of these carried short messages promoting meme coins, pleading for financial help, or advertising fraudulent schemes such as double‑your‑BTC scams. Some messages even referenced laundering methods involving mixing services and the privacy‑focused Monero blockchain.

Current status of the Liquid Network

As of the time of writing, the Liquid Network remains frozen while negotiations between Blockstream and the attackers continue. The on‑chain chatter persists, dominated by meme‑coin shills, desperate pleas, and scam pitches.