Hackers have withdrawn roughly $320 million in Bitcoin from the federation wallet backing Liquid Network, a Bitcoin sidechain developed by Blockstream, while insisting they are acting as white-hat security researchers rather than thieves. The incident matters because Liquid is used by exchanges and financial institutions, and it exposes how federated sidechains rely on trusted operators rather than Bitcoin's own mining-based security, meaning large sums can be moved without the underlying Bitcoin network itself being touched.

Liquid said around 4,000 of the roughly 4,200 BTC held in its federation wallet, about 95 percent, was withdrawn via SideSwap using a Peg-out Authorization Key, though neither that key nor any other appears to have been compromised, leaving the exact mechanism under investigation. The attackers left an on-chain message identifying themselves as "whitehats," asked Blockstream to make contact, and said they would return "most" of the funds once the underlying vulnerability was fixed and all nodes patched; Blockstream has since opened encrypted communications with them. Liquid has disabled its bridge nodes and asked exchanges to pause L-BTC deposits and withdrawals, and says other assets on the network, including stablecoins, were not directly affected.