Blockstream has halted its Liquid Network after roughly 4,000 bitcoin — worth nearly $320 million — moved out of the network's federation wallet. The attackers left an on-chain message claiming to be white-hat hackers, but Ledger's chief technology officer and others have pushed back on that characterization.
The halt and the drain
The Liquid Network, a sidechain built by Blockstream for faster and more confidential bitcoin transactions, was suspended after the unexpected movement of funds. The 4,000 BTC, valued at close to $320 million at current prices, left the federation wallet that holds the network's reserves. The halt appears to be a direct response to the incident.
The federation wallet is a multi-signature setup controlled by a group of functionaries, and it's the backbone of the Liquid sidechain. When a large amount of bitcoin suddenly exits that wallet, it raises immediate questions about security and control.
White-hat claims meet skepticism
The attackers left a message on the blockchain identifying themselves as white-hat hackers — a term used for security researchers who break into systems to expose vulnerabilities rather than to steal. But that claim has been met with doubt. Ledger's chief technology officer publicly rejected the white-hat characterization, and other voices in the crypto community have echoed that skepticism.
White-hat hackers typically coordinate with the affected project before or after an exploit, often returning funds and disclosing the vulnerability. In this case, the lack of coordination and the sheer size of the movement have led many to question the attackers' motives.
What's at stake
The Liquid Network is used by exchanges and institutional traders to move bitcoin quickly and privately. A halt of this scale disrupts those operations and could shake confidence in the sidechain's security model. The federation wallet is designed to be resilient, but this incident shows that even a multi-sig setup isn't immune to unexpected events.
The network remains halted, and there's no word on when it might come back online. The status of the 4,000 bitcoin is unclear.
