Liquid Network's Bitcoin (BTC) Bridge Drained of 4,000 BTC by Self-Described White Hats

4,000 BTC Leaves the Liquid Federation Wallet

Roughly 4,000 Bitcoin (BTC) — an estimated 95% of everything pegged to it — left the Liquid Network’s federation wallet on Saturday, and the actors behind the transfer insist they are white hats. Liquid is a Bitcoin layer-2 sidechain in which a federation of signers secures a two-way peg: users lock BTC on the base chain to receive an equivalent amount of Liquid Bitcoin (L-BTC), then redeem that L-BTC back through a peg-out process. In a statement posted to X, SideSwap said a customer sent 4,000 L-BTC to its peg-out service at 14:05 UTC, and the federation executed a payout of 3,996 BTC 23 minutes later. Blockstream has since traced the coins to a bug in the Elements software that powers the chain — notably, the SideSwap Peg-out Authorization Key used in the transfer was not compromised, meaning the drain exploited a code path rather than stolen keys.

SideSwap saidhttps://x.com/side_swap/status/2096709838310928674

The withdrawn funds were consolidated into a single Bitcoin address, bc1ql4mfu6aundtkksxklfajs2h3t9nzcd6gyqjlte, carrying an OP_RETURN note reading “we are whitehats. contact us on chain.” On-chain figures place the haul near $320 million, and Galaxy Research calculated it at roughly 95% of all Bitcoin pegged to Liquid. The network has been halted since about 9:00 EST Saturday morning: bridge nodes were disabled to stop new transactions from entering the chain, and venues that list L-BTC have paused or are preparing to pause deposits and withdrawals — a suspension now visible on major exchanges such as Coinbase and similar listing platforms. Liquid’s other issued assets, including USDT, DePix and tokenized real-world assets, remain unaffected. The team apologized for the disruption, saying federation members are actively working to restore normal network activity.

Galaxy Research calculatedhttps://x.com/glxyresearch/status/2096719101884350547?ref_src=twsrc%5Etfw

Ledger CTO Charles Guillemet Doubts the Label

Ledger’s chief technology officer, Charles Guillemet, was the most prominent security voice to dispute the white-hat framing. Genuine white hats, he argued, do not drain a bridge first and then solicit “on-chain” contact afterward; he likened the episode to the Ronin hack, in which attackers compromised validator keys to steal roughly $625 million, and pointed to the Euler case as a precedent for post-exploit negotiation. He later tempered the judgment, noting that criminal groups rarely attempt to contact their victims either, and allowed that the actors could be well-intentioned people who “intensively played with recent LLMs” and never learned responsible-disclosure norms.

The chain itself, meanwhile, has opened a negotiation channel. Early Monday, the holding address signed a fresh message asking whether returning most of the funds to the federation wallet would be acceptable. Public explorer data shows the coins have not moved: the address still controls about 3,998 BTC, while the federation wallet retains roughly 197 BTC. The episode has stirred FUD across Bitcoin-adjacent circles because it exposed how much wrapped supply ultimately rests on federation trust rather than pure cryptography. The solicitation was stamped into an OP_RETURN output on the base chain — cheap block space made available by Bitcoin’s SegWit upgrade — and it settles with the same finality that mining secures for every BTC transaction. Talk is cheap on-chain; signatures are not. Until the address moves coins, both readings — ethical stress test or elaborate heist — remain live. Readers tracking the market in real time can follow live spot and futures prices on Gate.

The Next Signature Decides 3,998 BTC

Strip the narrative away and the primary evidence is thin but clean: an OP_RETURN solicitation, a stationary pile of 3,998 BTC, Blockstream’s post-mortem identifying an Elements software bug, and remediation already executed — bridge nodes disabled, exchange suspensions in place, non-BTC Liquid assets confirmed untouched. COINOTAG’s reading: Guillemet’s Ronin parallel is the right stress test. A bulk return to the federation wallet validates the white-hat claim within days; any fragmentation toward mixing services converts a $320 million withdrawal into one of the year’s largest bridge thefts. The address, not the prose, will settle the question.