Liquid Network hack: how Blockstream's Bitcoin sidechain lost 4,000 BTC

01 — The message"we are whitehats. contact us on chain"

Late on Sunday afternoon UTC a Bitcoin tx confirmed that spent two coins back to the same wallet, one of them the whole peg-out, and sent 1,000 sats to the federation's peg wallet. Wedged between those outputs was an OP_RETURN, the small field where anyone can write a note into a block. The note read: "we are whitehats. contact us on chain".

The on-chain sleuth ErgoBTC had already seen it in the mempool seven minutes earlier and posted the question everyone was about to ask: "Liquid got got?"

Four hours before that, the federation had signed away 3,996 BTC in a single peg-out, more than nine tenths of all it held. Nothing about the tx looked forced. Eleven of the fifteen functionaries signed it, the way they sign every peg-out. The request came through SideSwap, a Liquid member whose peg-out key is on the whitelist. Every key did exactly what it was built to do, and the bitcoin left anyway.

02 — The premiseWhat Liquid is, and what a peg-out means

Liquid is a Bitcoin sidechain built by Blockstream. You lock bitcoin in the federation's multisig on the main chain, a peg-in, and the same amount of L-BTC appears on Liquid, where blocks arrive every minute and amounts are hidden by confidential transactions. Send L-BTC back to the peg, a peg-out, and the federation releases the bitcoin. Fifteen companies run the functionary boxes that sign blocks and hold the keys, and any 11 of them can move the bitcoin. Exchanges use Liquid to settle with each other, Tether issues USDT on it, and a handful of firms run peg-in and peg-out desks for anyone who does not want to deal with the federation directly. SideSwap is one of those desks. It charges 0.1 percent.

The promise under all of that is short. There is never more L-BTC than there is bitcoin in the peg wallet. On Saturday the wallet was full. By Sunday evening it was nearly empty.

Bitquery indexes the whole Bitcoin chain, and the Liquid chain is public too, so we did not have to take anybody's word for what happened. We pulled every tx the whitehat wallets made on both chains, rebuilt the peg-out from the federation's side, and read the messages both parties wrote into blocks, checking Blockstream's PGP sigs against its own key. What follows is that record: where the L-BTC came from, how it left, what the two sides have said to each other, and what Liquid looks like while it waits. One limit belongs up front. Amounts on Liquid are hidden and Blockstream has not named the bug, so the mint itself can be found in the record but not fully explained by it.

03 — The rehearsalTwo bitcoin in, a day of practice

The wallet that would drain the peg started with about 2 BTC of its own. Two peg-ins on the Friday, a little over a bitcoin each, arrived on Liquid as L-BTC by Saturday morning. Both were funded from a pile of small taproot coins, 24 in one and 39 in the other, which reads like a wallet that had been stacking sats for a while rather than a fresh CEX withdrawal. None of the funding wallets carries a label in our database or in MetaSleuth's.

Then the wallet went to work. From Saturday lunchtime UTC until Sunday afternoon it hopped through dozens of fresh addresses, then settled on two and made 92 txs from them on Liquid. Most were tiny: one input, three outputs, a 41-sat fee. They came in bursts, with a lull over night and a final short run around noon on Sunday. Anyone watching the mempool would have seen a busy wallet doing nothing much.

Seventy of those txs had one thing in common that ordinary wallets never produce. Each carried an OP_RETURN output with the asset written in plain, L-BTC, but the amount hidden. And 68 of them carried the same hidden amount and the same range proof, byte for byte, dropped into blocks across 14 hours.

Confidential transactions lean on range proofs. A hidden amount is fine as long as a proof shows it is not negative, because a negative output is how you print money. Nodes check thousands of these proofs and cache the ones they have already passed, so they do not do the work twice. Planting one proof 68 times over 14 hours looks like an effort to make sure every node on the network had that exact proof sitting in its cache. What the wallet then did with it is the one step the public record does not show.

04 — The exitOne transaction on Liquid, one on Bitcoin

The wallet ran three dry runs before the real thing: small peg-outs through SideSwap on Sunday morning UTC. Those were real L-BTC, or at least the federation treated them that way, and they proved the route worked end to end. SideSwap's payouts from all three were gathered into one coin of about 2.5 BTC and sent to a fresh Bitcoin address just after 14:00 UTC. That address is the one now holding all of it.

The mint came at 13:53 UTC, in a Liquid tx with one input, three outputs and a fee of 58 sats. It is the only tx in the wallet's whole history whose range proof is a different length from every other one it made. Both spendable outputs went to SideSwap within seven minutes. SideSwap swept them into its hot wallet, and its peg-out desk asked the federation for the full amount, plus a second, smaller peg-out for its own fee.

Then the federation paid, in one big tx that pulled together most of the coins the peg wallet had. The fee was pocket change.

In the same block SideSwap forwarded the customer's bitcoin, less its fee, to the address that had taken the dry-run payout half an hour earlier. The federation processed two more small peg-outs that afternoon before the bridge was switched off. That is how the peg wallet arrived at the balance it holds now.

05 — The conversationSix messages, all of them in blocks

Most hackers who want to talk open a Telegram account. This one wrote into Bitcoin, and Blockstream, after one short public note, decided to answer there too. Every message so far is a tx that pays 1,000 sats to the other side and carries the text in an OP_RETURN. We decoded all of them from the raw blocks, and the txids are in the record at the end.

Three details in the raw txs say more than the words. Blockstream's first reply came from a fresh address funded out of a two-key wallet with a long recovery timeout, the same form Blockstream's own Green wallet uses. Its second message was encrypted to the public key the whitehat had exposed by spending, in the Electrum ECIES format, and signed with the key whose fingerprint ends 6844 A2D6. We fetched that key from blockstream.com, imported it, and both sigs verify against "Blockstream Security Reporting". Change one character of either text and the check fails.

The whitehat's txs carry a tell of their own. Each sets a locktime just below the current height, the anti-fee-sniping habit of Bitcoin Core's wallet family, and each sweeps up every scrap of dust that others had sent to the address since the last message. That is why the second message has 15 inputs. By the time of the third, two dozen dust payments had arrived from outsiders wanting to be read: a Signal handle, a New York lawyer offering pro bono help with "a clean return", a wallet app plugging itself four times, a Monero swap desk promising no freezes, a second swap site openly pitching itself for laundering, and a memecoin. The whitehat spent all of it as fee change.

Not everyone reads the label the wallet gave itself. Charles Guillemet, Ledger's CTO, wrote on X that draining a bridge and then asking for on-chain contact "doesn't look like usual white hats practices". He added that criminal crews do not usually try to contact their victims either, and floated the idea of "people with good intentions that intensively played with recent LLMs and are not used to responsible disclosures".

06 — The bugWhat the code says, and what it does not

SideSwap said within hours that "the L-BTC came from an Elements bug, not from any SideSwap system", and Liquid said no key was compromised. Elements is the open-source software every Liquid node runs. Neither company has said which bug. The repo, though, has a public history, and one line in it is hard to ignore.

Before that change, a node remembered a range proof it had checked by the proof and the hidden amount alone. After it, the node also remembers which asset and which output script the proof was checked against. That is the same corner of the code the 68 planted outputs were aimed at. It fits what we see on chain, and it falls short of proof. The whitehat's own message says the chain "is under risk at latest commit right now", which reads as a claim that the fix in the repo is not the whole fix. We cannot test that claim. We can say the release everyone was running on Sunday did not have the patch, and that no release with it existed at the time of posting.

07 — Where it standsA paused chain and a five-cent peg

Liquid announced on Sunday evening that its bridge nodes were off and the chain was "effectively paused", and asked CEXs to stop L-BTC deposits and withdrawals. Blocks kept coming every minute, because the signers still make them, but nothing goes in. User txs fell from about 190 an hour on Sunday afternoon to two in the hour after midnight, and none since one in the morning UTC on Monday.

The bitcoin is where it was. The whitehat address holds all it received in one coin, the peg-out plus the dry-run payout plus the dust from others, and has spent nothing except message fees. Nothing sits in the mempool from it. The federation's peg wallet holds 197 BTC.

That number is the one that matters to everyone else. The minted L-BTC was destroyed when SideSwap pegged it out, so Liquid's own explorer still shows a supply that matches the wallet. The honest L-BTC did not go anywhere. Roughly 4,200 of it is still in CEX accounts and wallets, backed by those 197 BTC, which is about five cents of bitcoin per L-BTC until the coins come back. Tether's USDT on Liquid and the other issued assets are not touched by this, because they were never backed by the peg wallet in the first place.

08 — What we are watchingOpen threads

The whitehat has promised to return "most" of the money once the bug is fixed and every node is patched. Nobody has said what "most" means, and the gap between most and all is somebody's loss. Blockstream has said yes to the return and nothing about the bug. There is no patched release. The three dry-run peg-outs, and SideSwap's fee, are real bitcoin paid for L-BTC that never existed, and whether they are part of "most" is another open question. And Elements runs more than Liquid. If the bug is where the code history points, any sidechain on the same code had the same hole on Sunday.

We are re-reading both wallets as blocks arrive and will add each new message to the log at the top of this piece.

Anyone who wants to check a number here can pull the same records. We took the same route through the Coldcard theft, the Aquifer drain on Solana and the $120 million Tectonic exploit, and the OP_RETURN habit that carried this negotiation is the subject of what people write into Bitcoin blocks. Teams that do this work under a mandate use our crypto investigation services and the money flow tools behind them.