Attackers Move $319 Million in Bitcoin (BTC) Off Blockstream's Liquid Network

A $319 Million Peg-Out With a Message

Attackers moved roughly $319 million in Bitcoin (BTC) out of Blockstream's Liquid Network on Sunday, draining about 95% of the sidechain's reserves and leaving an on-chain note claiming whitehat status. The first peg-out cleared at 14:06 UTC, releasing 3,996 BTC to an address that had never appeared on-chain before. Roughly four hours later the funds moved again: the sender paid 269 satoshis — about 21 cents — in fees and embedded an OP_RETURN message anyone can read: “we are whitehats. contact us on chain.” The transfer is publicly verifiable on the mempool explorer. A dust return of 0.00001 BTC then went back to Liquid's own address, and the remaining 3,998.49 coins have not moved since. The scale is the striking part. Liquid's entire reserve stood near 4,193 coins on Saturday, meaning almost everything the network backed was burned inside a single day. Liquid functions as a wrapped Bitcoin sidechain, so the movement touches the custody layer for BTC deployed across Bitcoin DeFi applications. Nobody has claimed responsibility, and Blockstream has not said whether the sequence was an authorized recovery, a federation breach or something else entirely.

How the 11-of-15 Peg Held

Despite the outflow, the peg itself did not break — by design. Liquid's rule is that BTC can only leave the sidechain when the matching L-BTC tokens are destroyed first, so the reserve and the tokens it backs shrank in lockstep. On-chain data confirms remaining L-BTC holders are still covered to the fourth decimal place, with a surplus of just 0.22 coins — which rules out an insolvency story but leaves a more uncomfortable one. The mechanics point to insider-level capability. Under Blockstream's own documentation, only a federation member can burn the backing tokens; fifteen companies hold the keys and eleven of fifteen signatures are required before coins exit. That same documentation describes the whitelisted destination list as a failsafe keeping the federation in full control of the network's BTC — yet the payout landed on a brand-new address, a detail the company has neither explained nor commented on publicly. History offers two very different precedents: Ronin bridge attackers returned $10 million for a bounty in 2024, while Berlin refused to pay a 30 BTC ransom outright. The $319 million currently sits still, and whoever controls it has asked to be contacted on-chain.

Altcoin Open Interest Overtakes BTC

While Bitcoin (BTC) stalled near $80,000 — Bitstamp printed $79,796 as of 05:06 UTC Monday, a level the coin reached on a 38% rally off its July low — derivatives positioning migrated decisively toward the altcoin periphery. Aggregated open-interest data shows BTC futures and perpetual positions at about $25.1 billion, with $24 billion of that in perpetuals, while all other coins combined carried $40.4 billion in open interest and $40 billion in perpetuals alone. It marks the first time altcoin perpetual positioning has exceeded Bitcoin's since December 2024. Spot flows point the same way: the altcoin market cap excluding the top ten crossed $200 billion, up more than 10% in September, lifting the altcoin market even as total crypto capitalization rose just 1.37% to $2.71 trillion and BTC dominance held at 59.19%. Zcash (ZEC) dramatized the leverage behind the rotation — up 20% in 24 hours past $1,000 to $1,215.26, a 40.63% seven-day gain, with $36.6 million in leveraged positions liquidated, $34.5 million of them shorts. Market-wide 24-hour liquidations hit $125.63 million, the Fear & Greed Index read 75, and analysts are watching the Fed's September 16 rate decision as a constraint on any BTC breakout.

Federation Trust on the Line

The thread connecting Sunday is that risk now concentrates at Bitcoin's edges — in federation-governed sidechain custody and in leveraged altcoin derivatives. The Liquid case is fully auditable at the protocol layer: the peg-out hash is public, and the 0.22 BTC surplus shows no holder, from the smallest account to the largest whale, is short a single satoshi. What remains unverified is intent. Blockstream's documentation frames destination whitelisting as the control guaranteeing federation custody; that control either failed or was exercised deliberately, and until the team publishes a post-mortem, every interpretation — including the warning that stronger AI models raise the odds of the next major Bitcoin exploit — stays on the table. Meanwhile, L-BTC holders practicing plain HODL discipline remain fully backed, but the broader lesson stands: leverage and bridge trust, not Bitcoin itself, are where the stress is building.