On-Chain Message Left After $320M Bitcoin Exit from Liquid Network

On Sunday, a transfer of $319 million worth of Bitcoin (BTC) exited Blockstream's Liquid network. The transaction fee was 21 cents. Afterward, the sender inscribed a message on the blockchain, declaring themselves the good actors.

Although online observers are labeling the event a heist, the blockchain data reveals an unusual situation. The coins still in Liquid's reserves are fully backed to the fourth decimal.

We are aware of a security incident on @Liquid_BTC. Purported white-hat hackers have withdrawn ~4,000 BTC (~$320 million) from the Liquid Federation wallet. The @Blockstream team is working on contacting them on-chain with a signed message.

What we know so far is that the funds…

— Liquid Network 🌊 (@Liquid_BTC) September 6, 2026

$320M Crypto Reserve Moves, But the Wallet Left a Strange Message

At 14:06 UTC, the initial transaction went through, sending 3,996 coins to an address with no prior history. That transfer represented 95% of all the network's holdings.

A second transfer occurred four hours later. The sender spent 269 satoshis (roughly 21 cents) and attached an on-chain message that is publicly viewable.

Subsequently, they transferred 0.00001 BTC back to Liquid's own address. The remaining 3,998.49 coins have remained stationary.

“It looks like ~4,000 BTC just moved from the Liquid Network bridge all at once with an OP Return saying, “we are whitehats. contact us on chain”,” one user noted.

The Part Everyone Missed

Liquid operates under a single principle: to remove coins, one must first destroy the corresponding tokens within the network. Consequently, when the reserve decreased, the tokens backed by it decreased in tandem. Both ended up in approximately the same location.

Liquid got got?

Liquid Pegout tx 4000/4200 BTC
8db751a650ae2f12006b7e8c69a75e4df360e8afd6b9e05ae0b9fa6458a7b140

Hacker message: "we are whitehats. contact us on chain"
c103de95817b43f2df635ec6f35ff126ca26a7c6d20570c4b01866b2b3e69a19

— ∴FreeSamourai∴ (@ErgoBTC) September 6, 2026

The peg remains intact, with 0.22 coins in surplus. No holder of L-BTC is missing a single satoshi. This dispels the insolvency narrative. But it introduces a more troubling scenario. Combining what departed with what stayed, the network had approximately 4,193 coins on Saturday. Almost all were consumed to execute this transfer.

Blockstream specifies exactly who has that authority. Burning tokens is restricted to federation members. Fifteen companies control the keys, and a minimum of 11 signatures is required for any coin withdrawal.

The firm's documentation describes the whitelist of destinations as a safety measure.

Whitelisted addresses are used as a failsafe to ensure that the federation always remains in full control of the BTC held by the Liquid Network,” the team said in its documentation.

The funds were directed to an address that had never been used before. Blockstream has not provided any explanation, nor have they made any statement.

This mirrors an earlier incident, specifically the Ronin bridge attackers who returned $10 million and took a bounty in 2024.

The funds remain static, visible to all. The holder has requested to be contacted. No reply has been received.