Attackers Leave On-chain Message After $320 Million Exits Liquid Network

Someone pulled $319 million in Bitcoin (BTC) out of Blockstream’s Liquid network on Sunday. It cost 21 cents in fees. Then they left a note on the blockchain saying they were the good guys.

While the internet calls it a heist, the chain says something stranger. Liquid’s remaining coins are still fully covered, down to the fourth decimal place.

We are aware of a security incident on @Liquid_BTC. Purported white-hat hackers have withdrawn ~4,000 BTC (~$320 million) from the Liquid Federation wallet. The @Blockstream team is working on contacting them on-chain with a signed message.What we know so far is that the funds…

— Liquid Network 🌊 (@Liquid_BTC) September 6, 2026

Follow us on X to get the latest news as it happens 

$320M Crypto Reserve Moves, But the Wallet Left a Strange Message

The first move cleared at 14:06 UTC, releasing 3,996 coins to an address nobody had ever used before. That was 95% of everything the network held.

Four hours later the money moved again. The sender paid 269 satoshis, about 21 cents, and attached a message anyone can read.

Then they sent 0.00001 back to Liquid’s own address. The other 3,998.49 coins have not moved since.

“It looks like ~4,000 BTC just moved from the Liquid Network bridge all at once with an OP Return saying, “we are whitehats. contact us on chain”,” one user noted.

The Part Everyone Missed

Liquid runs on one rule: To take coins out, you destroy the matching tokens inside the network first. So when the reserve shrank, the tokens it backs shrank with it. Both landed in nearly the same spot.

Liquid got got?Liquid Pegout tx 4000/4200 BTC8db751a650ae2f12006b7e8c69a75e4df360e8afd6b9e05ae0b9fa6458a7b140Hacker message: "we are whitehats. contact us on chain"c103de95817b43f2df635ec6f35ff126ca26a7c6d20570c4b01866b2b3e69a19

— ∴FreeSamourai∴ (@ErgoBTC) September 6, 2026

The peg holds, with 0.22 coins to spare. Nobody still holding L-BTC is short a satoshi. That kills the insolvency story. However, it leaves a worse one. Add what left to what remains, and the network held about 4,193 coins on Saturday. Nearly all of them were burned to make this move work.

Blockstream is clear about who can do that. Only a federation member can burn the tokens. Fifteen companies hold the keys, and 11 must sign before coins leave.

Its documentation calls the destination list a safeguard.

Whitelisted addresses are used as a failsafe to ensure that the federation always remains in full control of the BTC held by the Liquid Network,” the team said in its documentation.

The coins went to a brand new address. Blockstream has not explained that, or said anything at all.

Traders have seen this before, particularly with Ronin bridge attackers who gave back $10 million and took a bounty in 2024.

The money sits still, in daylight. Whoever holds it asked to be contacted. Nobody has answered.