On Monday, an attacker pulled roughly 4,000 BTC — about $320 million — out of the Liquid Federation wallet. The group behind the move says it's a white-hat operation and that the funds will be returned once a bug is fixed. The incident has already forced exchanges to suspend LBTC deposits and withdrawals.
The withdrawal
The funds left the wallet using the SideSwap PAK (Peg-out Authorization Key), though the key itself wasn't compromised. The exchange began at 11:30 AM PDT with the hacker writing 'we are whitehats. contact us on chain.' As of 9:12 PM PDT, around 3,998.5 BTC remained unmoved.
The network has temporarily disabled its bridge nodes, pausing new transactions. Other assets on the network — USDT, DePix, real-world assets — were not affected.
White-hat claim and response
The hacker says the chain is under risk at the latest commit and requested that every node be patched before returning the funds. They've said they plan to send most of the money back and asked if a specified address was acceptable. They prefer public on-chain communication over email and even asked to be contacted on Signal.
Blockstream is attempting to contact the parties through signed on-chain messages. The company responded and later sent an encrypted PGP-signed message to the hacker's key. Crypto exchanges have been informed and have suspended or are preparing to suspend LBTC deposits and withdrawals.
Skepticism from Ledger CTO
Not everyone is buying the white-hat story. Ledger CTO Charles Guillemet expressed skepticism, saying legitimate white-hats would not typically drain a bridge and then ask to be contacted on-chain. He drew parallels with the Ronin hack and Euler exploit. The hacker's move to Signal did not change Guillemet's opinion.
What happens next
The hacker has not yet moved the bulk of the funds, and Blockstream is still waiting for a response to its PGP-signed message. The key question is whether the attacker will actually return the money after the patch — and whether the patch itself will be accepted by the network. No timeline has been given.
