Liquid's Attackers Called Themselves White Hats, Ledger's CTO Isn't Buying It

Ledger’s Chief Technology Officer has questioned the white hat label attached to the $320 million taken from Liquid Network.

He stopped short of calling it a theft. Liquid described the parties as purported white hat hackers, and Blockstream is trying to reach them on-chain.

Liquid Network Freezes Its Bridge as Self-Proclaimed White Hats Take 4,000 BTC

For context, Liquid is a Bitcoin (BTC) layer-2 network that operates as a separate blockchain. It uses a two-way peg to connect Bitcoin with its native Liquid Bitcoin (L-BTC) asset.

Users lock Bitcoin on the main network to receive an equivalent amount of L-BTC on Liquid. They can later redeem L-BTC for Bitcoin through the network’s peg-out process.

In an X post, the team stated that roughly 4,000 Bitcoin left the Liquid Federation wallet. Liquid said the transfer used the SideSwap Peg-out Authorization Key, which it insists was not compromised.

SideSwap explained that a customer sent 4,000 LBTC to its peg-out service at 14:05 UTC, and the federation paid out 3,996 BTC 23 minutes later. Blockstream has since traced that LBTC to a bug in the Elements software, according to the company.

The funds were consolidated into the Bitcoin address bc1ql4mfu6aundtkksxklfajs2h3t9nzcd6gyqjlte. It contained an on-chain message claiming the actors were white hats.

The message also asked Liquid to contact them on-chain. Galaxy Research estimated the funds represented about 95% of all Bitcoin pegged to Liquid.

Follow us on X to get the latest news as it happens

~4k BTC siphoned from Liquid Network, a Bitcoin sidechain. This was 95% of all BTC that had been pegged on Liquid.Liquid has been halted since ~9am EST this morning.The hacker(s) consolidated funds into a holding address with message “we are whitehats. contact us on chain” pic.twitter.com/K3cY0ca9YI

— Galaxy Research (@glxyresearch) September 6, 2026

In response, the network disabled bridge nodes, preventing new transactions from entering the chain. 

Liquid also notified exchanges, which have paused or are preparing to pause L-BTC deposits and withdrawals. Other Liquid assets, including USDT, DePix, and real-world assets, remain unaffected by the incident.

“Liquid wallets will be impacted, and we’re sorry for any inconvenience. Federation members are actively working on resolving this so we can restore normal network activity,” the team said.

Ledger CTO Doubts the White Hat Label

Charles Guillemet, chief technology officer at Ledger, questioned that description. He compared the episode to the Ronin hack, in which attackers stole about $625 million after compromising validator keys. He also linked the invitation to talk to Euler.

4,000 BTC just pegged out of the Liquid bridge. The OP_RETURN says "we are whitehats. contact us on chain."White hats don't drain a bridge and then solicit an "on-chain" contact. This echoes the Ronin hack, where attackers compromised validator keys to steal ~$625M, and the… pic.twitter.com/gPZmM13lXM

— Charles Guillemet (@P3b7_) September 6, 2026

Guillemet later softened his reading. The conduct does not look like usual white hat practice, he wrote, though criminal groups do not usually try to contact their victims either.

“There’s hope. This could be people with good intentions that intensively played with recent LLMs and are not used to responsible disclosures…,” the executive noted.

Where the Coins Stand

As of press time, the coins have not left the address that received them. Public records show it still holds about 3,998 BTC, while the federation wallet retains roughly 197 BTC.

Early Monday, the same address signed another message. It asked whether sending most of the funds back to the federation wallet would be acceptable.

Whether Guillemet’s doubts hold depends on what the address does next, not on what it writes.

Subscribe to our YouTube channel to watch leaders and journalists provide expert insights