Self-described white-hat hackers pulled about 4,000 BTC, worth roughly $320 million, from the federation wallet that backs Blockstream's Liquid Network. The Register reported Liquid saying the wallet held about 4,200 BTC beforehand, so nearly 95 percent of the reserves walked out. Liquid paused bridge nodes and asked exchanges to freeze L-BTC deposits and withdrawals while federation members dig in.
The attackers did not vanish into a mixer. They left an on-chain note calling themselves whitehats and asked Blockstream to talk. Blockstream answered on-chain with security contacts, then the chat moved to encrypted channels. The group said it would return most of the Bitcoin after the bug is patched and every node is updated. Their message was blunt: fix first, then we send the money back safely.
How the funds moved is the weird part. Liquid said the withdrawal went through SideSwap using a Peg-out Authorization Key, yet neither SideSwap's key nor other PAKs looked compromised. That leaves a hard question. How does an apparently authorized peg-out empty almost the whole federation wallet without those keys being stolen. Other Liquid assets such as stablecoins were not directly hit, and Bitcoin's main chain was untouched.
I build software, and this is a classic bridge lesson wearing a white hat. Liquid is a federated sidechain. Members collectively guard the Bitcoin that backs L-BTC. That is not the same security model as Bitcoin miners. Add Bitcoin to a system and you still inherit the weakest control plane in that system.
For regular people, the useful takeaway is boring and true. Sidechains and bridges are extra trust, not free safety. If you hold L-BTC or trade on venues that depend on Liquid, treat the pause as a live incident until the patch is verified and the funds are back. The hopeful ending is a fixed bug and returned coins. The risky ending is a long argument over what "most" means.
A peg-out is how Liquid turns L-BTC back into real Bitcoin on the main chain. Federation members are supposed to approve only destinations they recognize. If that gate fails while the keys look fine, the bug is likely deeper in node software or confidential transaction handling. That is why the attackers demanded a patch before returning funds. Leaving a known hole open while the chain restarts would invite copycats.
Later reporting said most of the coins were returned after patch talk, with a slice kept as a disputed bounty. Even so, the first day lesson stands. When a bridge pauses, wait for confirmation from the operators you trust, not from social media rumors.
