A Bitcoin Network Lost $320 Million In A Hack. The Attackers Say They’re The Good Guys

Hackers withdrew roughly 4,000 Bitcoin worth about $320 million from Liquid Network, draining about 95% of the Bitcoin held in the network's federation wallet and forcing the Bitcoin-linked settlement system to halt new transactions.

Liquid said the Bitcoin was taken from a wallet that held about 4,200 BTC and described those responsible as "purported white-hat hackers," a term commonly used for security researchers who identify vulnerabilities rather than exploit them for conventional theft. The network said users' Liquid wallets would be affected while federation members worked to address the breach, Bloomberg reported.

The incident occurred through SideSwap, a platform authorized to process withdrawals from Liquid, rather than through the theft of the cryptographic key used to authorize those transactions. Liquid said the SideSwap Peg-out Authorization Key was not compromised, Reuters reported Monday.

More details about the mechanism behind the withdrawal emerged after the initial disclosure. SideSwap said a customer sent 4,000 L-BTC to its peg-out service on Sunday. The tokens were burned through what appeared to be a valid authorization, after which the Liquid Federation paid 3,996 BTC to the customer's Bitcoin address.

Blockstream subsequently determined that the L-BTC involved had been created through a bug in Elements, the software underpinning Liquid, rather than being backed by Bitcoin as it normally would be. SideSwap said its own systems and peg-out authorization key had not been compromised, The Block reported.

Liquid operates as a Bitcoin sidechain, allowing users and exchanges to settle transactions more quickly than they typically can on Bitcoin's main blockchain. Bitcoin deposited into the system is locked while an equivalent amount of Liquid Bitcoin, or L-BTC, is issued on the Liquid network. The system is designed so that each L-BTC is backed one-for-one by Bitcoin.

Blockstream launched Liquid in 2018. The network is now governed by a federation made up of more than 80 exchanges, trading desks, infrastructure providers and other companies. Blockstream has listed exchanges including Bitfinex and BTSE among businesses using Liquid, while BitMEX has also used the network.

The attackers have since communicated with Blockstream through messages recorded on the Bitcoin blockchain and said they would return most of the Bitcoin once the underlying vulnerability was fixed. Blockstream later sent a signed message saying its bridge nodes had been patched and that the funds could safely be returned. The roughly 4,000 BTC remained in the attacker's wallet at the time of that report.

The Liquid breach comes little more than a month after another security problem hit Bitcoin holders. Coldcard, a hardware wallet made by Coinkite, urged affected customers in August to move their Bitcoin after an exploit involving weakly generated wallet keys. The vulnerability had been present in certain firmware dating to 2021 and had resulted in losses estimated at as much as $114 million by early August, a CoinDesk report said.

Crypto theft has also become part of a broader international security problem as state-backed hacking groups increasingly target digital assets. North Korean hackers have been particularly active, with an international sanctions-monitoring group reporting last year that billions of dollars stolen through cryptocurrency attacks and fraudulent overseas technology work had helped finance Pyongyang's nuclear weapons and ballistic missile programs, The Associated Press reported.

That activity has included one of the largest cryptocurrency thefts on record. Hackers stole about $1.5 billion in Ether from the Bybit exchange in February 2025, an attack later attributed by U.S. authorities to North Korea. The theft was more than twice the size of several previous major crypto heists, while cryptocurrency hacking proceeds had already exceeded $2 billion in 2024, marking the fourth consecutive year in which stolen proceeds topped $1 billion.

North Korea has also deepened its military relationship with Russia during the war in Ukraine, while international investigators have said cryptocurrency theft and other cyber operations have helped Pyongyang evade sanctions and finance its weapons programs. There is no indication that the Liquid Network breach is connected to North Korea, Russia or any other state-backed actor.

For Liquid, the immediate response has centered on securing the network and its Bitcoin reserves. Bridge nodes were disabled and exchanges were asked to suspend L-BTC deposits and withdrawals while the vulnerability was addressed. Other assets issued on Liquid, including USDT, were not affected by the breach, according to the network.