Liquid Network Halts After $320 Million Bitcoin Exploit; Hackers Claim White‑Hat Motive

Liquid Network, the Bitcoin sidechain operated by Blockstream that many exchanges use for fast settlement, announced on Monday that it has frozen all activity after a security exploit led to the unauthorized withdrawal of about 4,000 BTC, valued at roughly $320 million at current market prices. The breach, disclosed simultaneously by several crypto news outlets, represents one of the largest single‑asset losses in the sector this year.

What is Liquid and why it matters

Liquid is a “layer‑2” solution built on Bitcoin’s Elements codebase, offering confidential and near‑instant transfers between participating financial institutions. Because it settles Bitcoin transactions off‑chain, it is widely used by large exchanges to reduce on‑chain congestion and lower transaction fees. The network’s interruption therefore has immediate implications for liquidity providers and traders who rely on its fast‑track settlement.

Details of the breach and the alleged “white‑hat” response

According to multiple reports, the attackers exploited a vulnerability in the Elements protocol to move the BTC to an address they control. Blockstream confirmed that the total amount taken equals roughly 4,000 BTC. The perpetrators left an on‑chain message stating they are “white‑hat” hackers and will return most of the funds once the flaw is corrected.

“We are white‑hat hackers. We will return the funds after the Elements vulnerability is patched across the network,” the note read, as reported by Cointelegraph.

Cointelegraph also noted that the actors have pledged to return the majority of the stolen Bitcoin, though no timeline was provided. Blockstream has not publicly identified the individuals behind the exploit, but it has engaged with the parties to negotiate a restitution plan.

Security researchers have confirmed that the flaw resides in the Elements code, which underpins Liquid and several other sidechains. Until a patch is deployed, Blockstream said it will keep the network in a paused state to prevent further unauthorized withdrawals. The company is working with independent auditors and the broader Bitcoin development community to validate the fix before re‑enabling transactions.

Market reaction and broader implications

The incident arrived as Bitcoin’s price hovered around $27,000, with the broader crypto market showing resilience after a series of regulatory headlines earlier in the year. Nevertheless, the $320 million loss sparked short‑term volatility: Bitcoin futures on CME dipped 1.2 % on the day, while spot exchanges reported a modest outflow of $45 million, according to data compiled by CoinDesk.

In a parallel development, Bitcoin exchange‑traded funds (ETFs) recorded their strongest three‑week inflow of 2026, attracting roughly $1.3 billion of new capital, as noted by Cointelegraph. Analysts suggested that the ETF inflows reflect continued institutional confidence despite the Liquid breach, but warned that security lapses on high‑profile infrastructure could erode trust if not swiftly remedied.

Regulators in the United States and Europe have previously warned that custodial platforms must maintain robust security standards. While the Liquid Network is not a custodial exchange, its role in the settlement chain places it under similar scrutiny. The U.S. Securities and Exchange Commission (SEC) has not issued a formal statement on the hack, but a spokesperson indicated that the agency monitors “all significant events that could affect market integrity.”

Blockstream’s decision to pause Liquid underscores the growing importance of rapid incident response in the crypto ecosystem. The company pledged to release a detailed post‑mortem once the patch is verified, and to compensate affected exchange partners as appropriate. Until then, users of Liquid‑linked services are advised to seek alternative settlement channels and to monitor official communications for updates.