Alleged White-Hat Hackers Withdraw 4,000 bitcoin from Blockstream’s Liquid Network Federation Reserves
White‑hat hackers exploited a Liquid Network consensus bug to mint unbacked L‑BTC and withdrew 4,019 BTC from the federation’s multisig treasury.
2 min
Written with AI assistance from the reporting linked below, and reviewed before publication. How we write
Bitcoin Magazine — Mining reported Sunday that actors claiming to be white-hat hackers withdrew 4,019.4 BTC, valued at roughly $320 million at the time, from the federation wallet that backs L-BTC on the Liquid Network. Bridge nodes were disabled and the sidechain paused, though block production continues. For miners, the incident underscores a custody risk that sits outside the main chain: a federated peg secured by 15 known entities and an 11-of-15 multisig can be drained when a consensus bug lets attackers mint unbacked sidechain assets that the federation's hardware security modules then treat as valid withdrawal requests.
The withdrawal mechanism
The Liquid Network, founded by Blockstream, issues L-BTC 1:1 against bitcoin held in a multisig treasury. Before the breach the treasury held over 4,200 BTC. Blockstream's proof-of-reserves page showed a little over 207 BTC remaining afterward. The attackers exploited what appears to be an inflation bug on the LBTC sidechain to create more than 4,000 LBTC with no main-chain backing. They then used the SideSwap Peg-out Authorization Key — SideSwap is a federation member and bridge exchange — to convert those tokens into on-chain bitcoin. Because the peg-out transaction looked valid under the buggy consensus rules, the federation members' HSMs signed the withdrawal.
Federation structure and the failure point
Liquid's security model relies on 15 corporate signers. Eleven signatures are required to move treasury funds. The bug did not compromise the multisig itself. It tricked the signers' automated HSMs into authorizing a transaction that spent bitcoin the federation no longer effectively controlled. Other issued assets — USDT, DePix, and tokenized real-world assets — were unaffected, according to the Liquid Network's official X account. Exchanges were instructed to halt L-BTC deposits and withdrawals. JAN3 CEO Samson Mow confirmed that Aqua wallet's Liquid features were impacted while on-chain bitcoin functionality remained normal.
Implications for mining economics
No direct hashprice, power-cost, or payout-timing impact has been documented. The 4,019.4 BTC involved represent roughly 0.02% of the 21 million supply and were already off the market in a federation treasury. A sustained loss of confidence in federated sidechains could reduce demand for peg-in services that some miners use to move coins between chains. A broad risk-off move in bitcoin spot markets would feed through to hashprice. Operators should monitor hashprice feeds over the next 48–72 hours for any correlation with Liquid-related headlines.
Watch whether the hackers follow through on their on-chain message — "we are whitehats. contact us on chain" — and return the bulk of the funds for a finder's fee. If the coins begin moving through mixers or exchanges instead, that signals a full theft and likely triggers wider market selling.