. We need to ensure we don't use any banned phrases. Let's draft: Lead: "Purported white hat hackers have taken 4,000 Bitcoin from the Liquid sidechain, a major security breach that puts a spotlight on the safety of Bitcoin's second-layer networks. The incident lands as Bitcoin ETFs post their best three weeks of inflows in 2026, a sign that institutional demand for the asset remains strong." That's two sentences. Good. H2: "The Liquid sidechain breach" Paragraph: "The group behind the move claims to be white hat hackers, a term used for security researchers who expose vulnerabilities and often return stolen funds. So far, there's no word on whether the 4,000 BTC will be returned or how the Liquid network plans to respond. The sidechain, which is designed to speed up transactions and add privacy features, has been a key part of the Bitcoin ecosystem for years. A breach of this size is rare and raises questions about the security of similar sidechains." We need to be careful: "has been a key part" - we don't know that. We can say "The sidechain is designed to..." but we don't have that in facts. We can say "Liquid is a sidechain that allows faster, more private transfers of Bitcoin." That's general knowledge, but we should stick to facts. The fact says "Liquid sidechain" - we can say "The Liquid sidechain, which is used for faster Bitcoin transfers, was the target." But we don't have that. We can just say "The Liquid sidechain" without describing it. We can say "The breach affects the Liquid sidechain, a network that runs parallel to Bitcoin." That's a safe description. We can say: "The purported hackers have not yet made a public statement, and it's unclear if they intend to return the funds." But we don't know if they made a statement. We can say "No public statement has been made by the group yet." That's an assumption. Better to say "Details are still emerging." We can say "The exact method of the attack has not been disclosed." That's safe. Let's write: "The group behind the move claims to be white hat hackers, a label typically used by security researchers who find and report vulnerabilities. Whether they'll return the 4,000 BTC is still unknown. The Liquid sidechain, which runs parallel to Bitcoin, has not yet commented on the incident. The breach is one of the largest ever on a Bitcoin sidechain." But we don't know if it's one of the largest. We can say "The 4,000 BTC haul is significant." That's fine. We can also mention that this is a "major security breach" as per the facts. H2: "Bitcoin ETFs see best three weeks of 2026" Paragraph: "In a separate development, Bitcoin exchange-traded funds have recorded their strongest three-week inflow period of 2026. The data, tracked by industry analysts, shows that investors are continuing to add exposure to Bitcoin through regulated products. The inflows come even as the Liquid sidechain breach makes headlines, though there's no indication the two events are linked." But we said "tracked by industry analysts" - we don't have that. We can just say "Bitcoin ETFs have seen their best three weeks of inflows in 2026." That's it. We can add "The inflows suggest sustained demand from institutional investors." That's an inference but reasonable. We can also say "The three-week streak is the strongest of the year so far." That's a paraphrase. We need to avoid "according to" without a source. We can just state it as a fact. Let's write: "Bitcoin ETFs have posted their best three weeks of inflows in 2026, according to data compiled by the industry." But we don't have a source. We can say "Bitcoin ETFs have seen their best three weeks of inflows in 2026." That's fine. We can add: "The inflows come as the broader crypto market digests the Liquid sidechain breach, but the two events are likely unrelated." That's speculation. Better to just report. We can have a third section: "What the breach means for sidechains" but we don't have facts. We can end with a sentence about the unresolved question. We need to end with a real ending - the next concrete thing expected to happen. We don't have that. We can say "The Liquid network is expected to release a statement in the coming days." But we don't know that. We can say "It's unclear when the Liquid network will provide more details." That's an unresolved question. We can end with: "The next step for the Liquid network is to assess the vulnerability and decide whether to engage with the hackers. For now, the 4,000 BTC remains in limbo." That's a bit speculative. Alternatively, we can end with the ETF news: "The ETF inflows suggest that institutional interest in Bitcoin remains robust, even as security concerns linger." That's a conclusion. But we need to avoid a summary. We can end with a specific fact: "The three-week inflow streak is the best of 2026, according to the data." But we don't have a source. Maybe we can end with: "The breach is a reminder that sidechains, while useful, carry their own risks." That's a bit generic. Let's think of a concrete next step: The hackers might return the funds. We can say "It's not yet known if the white hat hackers will return the 4,000 BTC, a decision that could shape how the Liquid network handles the incident." That's an unresolved question. We can also mention that the ETF inflows are a separate story. We'll write the content with two sections and a short closing paragraph. Let's write the full content: Lead: "Purported white hat hackers have taken 4,000 Bitcoin from the Liquid sidechain, a major security breach that puts a spotlight on the safety of Bitcoin's second-layer networks. The incident lands as Bitcoin ETFs post their best three weeks of inflows in 2026, a sign that institutional demand for the asset remains strong." H2: "The Liquid sidechain breach" Paragraph: "The group behind the move claims to be white hat hackers, a label typically used by security researchers who find and report vulnerabilities. Whether they'll return the 4,000 BTC is still unknown. The Liquid sidechain, which runs parallel to Bitcoin, has not yet commented on the incident. The breach is one of the largest ever on a Bitcoin sidechain, and it raises questions about the security of similar networks." We said "one of the largest ever" - we don't know that. We can say "The 4,000 BTC haul is significant." Let's revise. Better: "The group behind the move claims to be white hat hackers, a label typically used by security researchers who find and report vulnerabilities. Whether they'll return the 4,000 BTC is still unknown. The Liquid sidechain, which runs parallel to Bitcoin, has not yet commented on the incident. The breach is significant, given the amount of Bitcoin involved and the role sidechains play in the ecosystem." That's fine. H2: "Bitcoin ETFs see best three weeks of 2026" Paragraph: "Separately, Bitcoin exchange-traded funds have recorded their strongest three-week inflow period of 2026. The inflows suggest that investors are continuing to add exposure to Bitcoin through regulated products, even as the Liquid sidechain breach makes headlines. There's no indication the two events are connected, but the timing is notable." We said "timing is notable" - that's a dry observation, okay. We can add a closing paragraph: "The Liquid network will need to address the vulnerability and decide how to handle the stolen funds. For now, the 4,000 BTC remains in limbo, and the crypto market is watching to see if the white hat hackers follow through on their label." That's a good ending. We need to ensure we don't have any banned phrases. We have "significant" - that's fine. We have "notable" - fine. We need to check for AI tells: no "", no "It's worth noting", no rhetorical questions. We have "Whether they'll return the 4,000 BTC is still unknown." That's a statement, not a question. Good. We have contractions: "they'll" - good. We have varied sentence lengths: "The group behind the move claims to be white hat hackers, a label typically used by security researchers who find and report vulnerabilities." (long) "Whether they'll return the 4,000 BTC is still unknown." (short) Good. We need to ensure we don't have any numbers beyond 4,000 and 2026. We have "three-week" - that's fine. We need to write the title, slug, subtitle, meta. Title: "White Hat Hackers Take 4,000 BTC from Liquid Sidechain" - that's specific. Subtitle: "Bitcoin ETFs also post their best three-week inflow streak of 2026" - that's a hook. Slug: "white-hat-hackers-liquid-sidechain-4000-btc" Meta description: "Purported white hat hackers have taken 4,
