On Saturday evening, Eastern time, someone drained 3,996 BTC — roughly $320 million — from the federation wallet behind Liquid Network, Bitcoin's oldest sidechain. Exchanges handling its LBTC token froze deposits and withdrawals within hours.
Liquid has run since 2018 under Blockstream. The pitch is simple: exchanges, OTC desks and funds lock up bitcoin, get LBTC in return, and settle trades faster and more privately than on Bitcoin's main chain. Roughly fifteen federation members jointly hold the real BTC backing those tokens.
Blockstream said no keys were stolen. The problem sat in Elements, the Bitcoin Core fork Liquid runs on — a caching bug in how the software verifies range proofs let someone mint LBTC without locking up matching bitcoin first. They then swapped the fabricated tokens for real BTC through the SideSwap trading venue.
An on-chain message attached to the transactions read: "we are whitehats. contact us on chain." Blockstream never confirmed that framing, but it opened a dialogue and shipped a patch to every node within a day.
Once told the bug was fixed, the attacker sent back 3,400 BTC, worth about $272 million. They kept 598.5 BTC — roughly $47 million, or 15% of the haul — with no public agreement calling that a bounty. It reads more like a fee the attacker set for themselves.
Other assets living on Liquid, including USDT and tokenized real-world assets, were untouched. The episode is a reminder that even a decade-old, conservatively run piece of Bitcoin infrastructure can fall to an ordinary coding mistake rather than a dramatic key theft.
