Nearly 4,000 BTC Drained From Blockstream’s Liquid Peg

On Sunday, an on‑chain transaction transferred approximately 3,998.5 BTC from the Liquid Network’s federation wallet, reducing the reserve from about 4,200 BTC to just 207 BTC. The transaction was accompanied by a message stating, “we are whitehats. contact us on chain.”

What Was Observed

Researcher Ergo BTC identified two linked transactions: a large peg‑out of roughly 4,000 BTC and a subsequent spend of the same amount that included the “whitehats” note. Blockstream’s Liquid explorer then displayed federation holdings of 207.275 BTC.

How Liquid’s Peg‑Out System Works

Normally, LBTC is destroyed on Liquid before federation members process the corresponding Bitcoin withdrawal. Withdrawals require an 11‑of‑15 multisignature from the federation and are limited to approved member wallets via the Peg‑out Authorization Key system.

Possible Explanations

• A compromised whitelisted wallet could have been used to authorize the transfer.
• Abuse of Liquid’s security mechanisms might have allowed the movement.
• A coordinated “white‑hat” extraction could have been performed to protect funds after discovering a vulnerability.

None of these scenarios have been confirmed, and the “white‑hat” claim has not been verified.

Current Status

The transferred BTC remains on the Bitcoin blockchain and shows no signs of mixing. Blockstream, Liquid, and Adam Back have not publicly addressed the incident as of the time of reporting. The next development will be an official statement or response through the on‑chain channel opened by the unidentified party.