NewsSecurity'We Are Whitehats': Nearly 4,000 BTC Drained From Blockstream's Liquid PegPublished:Sep 6, 2026, 3:17 PM EDTAccording to several reports, nearly 4,000 bitcoin worth roughly $319 million appear to have moved out of the Liquid Network’s federation wallet Sunday, followed by an onchain message from an unidentified party claiming, “we are whitehats. contact us on chain.” The developing story remains unconfirmed by the network’s team, and neither Blockstream, Liquid, nor Adam Back had publicly addressed the incident as of roughly 3 p.m. EDT.WRITTEN BYSHAREPublished: Sep 6, 2026, 3:17 PM EDTKey TakeawaysLiquid’s reserve fell from roughly 4,200 BTC to 207 BTC after nearly 4,000 BTC moved.Blockstream faces questions as the transferred bitcoin was worth about $319 million.Liquid users await answers after a “whitehats” message appeared Sept. 6. Liquid’s Bitcoin Peg Plunges From Roughly 4,200 BTC to 207 BTC Onchain researcher Ergo BTC flagged two linked bitcoin transactions, including a large Liquid peg-out described as roughly 4,000 BTC leaving a pool of about 4,200 BTC. A follow-up transaction spent approximately 3,998.5 BTC and included the “whitehats” message. Blockstream’s Liquid explorer subsequently showed federation holdings of just 207.275 BTC, a significant drop from the roughly 4,200 BTC that had backed the network for months. Image source: X The move is drawing a great deal of attention because Liquid’s peg-out system is not designed to let anyone simply pull bitcoin from the sidechain. Normally, LBTC is destroyed on Liquid before federation functionaries process the corresponding bitcoin withdrawal. Image source: Blockstream.info. Mainchain funds require an 11-of-15 federation multisignature, while the Peg-out Authorization Key system is intended to restrict payments to approved member wallets. Right now, how all of this happened is quite a mystery. ‘Whitehats’ Claim Leaves Liquid Facing a Big Unanswered Question What happened behind the scenes is anyone’s guess. There are possibilities to this particular security issue, including a compromised whitelisted wallet, abuse involving Liquid’s security mechanisms, or a coordinated white-hat extraction intended to protect funds after discovering a vulnerability. None has been confirmed. Treating the “whitehat” message as proof of good intentions would be jumping ahead of the evidence as well. Nearly 4,000 BTC Remains Concentrated as Liquid Users Await Answers For now, the bitcoin (BTC) is reportedly concentrated on the Bitcoin blockchain and had not obviously been mixed at the time of writing. The next significant development will be whether Blockstream or Liquid confirms an incident, explains why the reserve collapsed from roughly 4,200 BTC to 207 BTC, or responds through the onchain channel apparently opened by the unidentified party. Until the dust settles, the cause of the massive transfer remains unconfirmed. By 4:25 p.m. EDT on Sunday, Blockstream’s Liquid Network issued a response. “We are aware of a security incident on Liquid BTC. Purported white-hat hackers have withdrawn ~4,000 BTC (~$320 million) from the Liquid Federation wallet. The Blockstream team is working on contacting them on-chain with a signed message. What we know so far is that the funds were withdrawn via the SideSwap PAK (Peg-out Authorization Key), but that key was not compromised, nor were any others,” the X account stated. “Exchanges have been notified and have already paused (or will pause) LBTC deposits and withdrawals,” the Liquid Network X post continued. “Other Liquid assets such as USDT, DePix, and RWAs are unaffected by this security incident. Bridge nodes have been temporarily disabled, so no new transactions can be submitted to the network. Effectively, the Liquid sidechain is paused until this issue is resolved. Liquid wallets will be impacted, and we’re sorry for any inconvenience. Federation members are actively working on resolving this so we can restore normal network activity.”