{"id":77815,"date":"2026-09-07T01:19:43","date_gmt":"2026-09-07T01:19:43","guid":{"rendered":"https:\/\/crowdfundjunction.com\/blog\/blockstream-hunts-white-hats-after-4000-btc-leaves-liquid-bitcoin-news\/"},"modified":"2026-09-07T01:19:43","modified_gmt":"2026-09-07T01:19:43","slug":"blockstream-hunts-white-hats-after-4000-btc-leaves-liquid-bitcoin-news","status":"publish","type":"post","link":"https:\/\/crowdfundjunction.com\/blog\/blockstream-hunts-white-hats-after-4000-btc-leaves-liquid-bitcoin-news\/","title":{"rendered":"Blockstream Hunts &#8216;White Hats&#8217; After 4,000 BTC Leaves Liquid \u2013 Bitcoin News"},"content":{"rendered":"<p><b>(Originally posted on : Bitcoin News )<\/b><br \/>\n<\/p>\n<div>\n<div class=\"@container mb-[25px] rounded-sm overflow-clip py-0.5 pr-0.5 pl-2.5 bg-success-100\">\n<div class=\"flex flex-col gap-m overflow-clip rounded-[6px] !bg-success-10 p-3 @[420px]:p-m\">\n<h2 class=\"m-0 flex items-center gap-s text-[19px] !text-[#1c1c1c] md:text-[20px]\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"16\" height=\"10\" viewbox=\"0 0 16 10\" fill=\"none\" class=\"shrink-0 text-success-100\" aria-hidden=\"true\"><path d=\"M1 1.5h14\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\"\/><path d=\"M1 8.5h10\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\"\/><\/svg><span>Key Takeaways<\/span><\/h2>\n<ul class=\"m-0 flex list-none flex-col gap-m pl-0\">\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">Blockstream paused the Liquid network layer two (L2) after roughly 4,000 BTC, worth $320 million, was withdrawn by so-called white hat hackers on Sept. 6.<\/span><\/li>\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">Sideswap\u2019s Elements bug raises new security concerns after 3,996 BTC cleared its peg-out service.<\/span><\/li>\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">Blockstream explained that it is in the midst of contacting the \u201cwhite hats\u201d as Liquid\u2019s incident remains unresolved. The firm has sent a message onchain.<\/span><\/li>\n<\/ul>\n<\/div>\n<\/div>\n<h2>4,000 BTC Exit Liquid as Blockstream Scrambles to Contain Exploit<\/h2>\n<p>On Sunday afternoon, the <a href=\"https:\/\/x.com\/ErgoBTC\/status\/2096665561392361473\" target=\"_blank\" rel=\"noopener noreferrer\">onchain sleuth Ergo BTC discovered<\/a> that Blockstream\u2019s Liquid network had been exploited and following that alert, several others began sharing the news. Bitcoin.com News <a href=\"https:\/\/news.bitcoin.com\/security\/we-are-whitehats-nearly-4000-btc-drained-from-blockstreams-liquid-peg\/\">reported on the story<\/a> at 3:17 p.m. EDT on Sept. 6, and since then, Liquid\u2019s maintainers have confirmed the exploit. At 4:25 p.m., Blockstream noted that roughly 4,000 BTC (about $320 million) was withdrawn, and apparently, the action was carried out by white hat hackers.<\/p>\n<p>Basically, white hat hackers are ethical cybersecurity experts who sometimes exploit vulnerabilities like this one to show it can be done before actual criminals exploit the same weakness. Blockstream said that the network has been paused, and exchanges have been told to halt L-BTC deposits and withdrawals.<\/p>\n<figure id=\"attachment_845525\" aria-describedby=\"caption-attachment-845525\" style=\"width:1314px\" class=\"wp-caption aligncenter\"><figcaption id=\"caption-attachment-845525\" class=\"wp-caption-text\">Ledger CTO Charles Guillemet shares his opinion on the so-called white hats on X.<\/figcaption><\/figure>\n<p>The firm also noted that it is attempting to contact the white hats onchain. In addition to the Liquid Network X account, Sideswap.io also revealed that someone exploited a bug in Blockstream\u2019s Elements software.<\/p>\n<p>\u201cToday at 14:05 UTC, a customer sent 4,000 L-BTC to the SideSwap peg-out service,\u201d Sideswap\u2019s X account <a href=\"https:\/\/x.com\/side_swap\/status\/2096709838310928674?s=20\" target=\"_blank\" rel=\"noopener noreferrer\">wrote on the social media platform<\/a>. \u201cOur service processed it like any other order: the L-BTC was burned on Liquid with a valid peg-out authorisation, and at 14:28 UTC, the Liquid Federation paid 3,996 BTC to the customer\u2019s Bitcoin address. Blockstream has since established that the L-BTC in that order was created through a bug in the Elements software.\u201d<\/p>\n<h2>Questioning the \u2018White Hat\u2019 Claim<\/h2>\n<p>The crypto community was not so kind after this event, and several accounts on X criticized the project. \u201cKick this software [to] the curb, you\u2019re toast,\u201d one individual <a href=\"https:\/\/x.com\/2FreeTheMoney\/status\/2096712169559622078?s=20\" target=\"_blank\" rel=\"noopener noreferrer\">wrote in reply to Sideswap\u2019s message<\/a>. Alongside this, Blockstream responded onchain and wrote, \u201cPlease contact security@blockstream.com\u201d in an OP_RETURN message. Ledger CTO Charles Guillemet explained that the so-called white hat hackers\u2019 moves do not look like a typical white hat.<\/p>\n<p>\u201cThey now ask to be contacted on Signal. It doesn\u2019t look like usual white hats practices, but usual criminal orgs don\u2019t usually try to contact their victims either. There\u2019s hope. [These] could be people with good intentions that intensively played with recent LLMs and are not used to responsible disclosures,\u201d <a href=\"https:\/\/x.com\/P3b7_\/status\/2096705787221655938?s=20\" target=\"_blank\" rel=\"noopener noreferrer\">Guillemet said on X<\/a>.<\/p>\n<h2>Liquid Fallout Hits Aqua as Samson Mow Details the Impact<\/h2>\n<p>Samson Mow, the CEO of JAN3, the bitcoin technology firm that developed the Aqua Wallet, <a href=\"https:\/\/x.com\/Excellion\/status\/2096714210231099512?s=20\" target=\"_blank\" rel=\"noopener noreferrer\">also shared his two cents<\/a>. \u201cThe working theory is that the vulnerability is with Liquid\u2019s Confidential Transactions, but devs cannot confirm at this time. The vulnerability is a node level isue and is not related to PAKs or HSMs,\u201d Mow wrote. He further stated that his product Aqua, is impacted.<\/p>\n<p><a href=\"https:\/\/x.com\/Excellion\/status\/2096697852269670499?s=20\" target=\"_blank\" rel=\"noopener noreferrer\">Mow wrote:<\/a><\/p>\n<blockquote>\n<p>\u201cEveryone is actively working to resolve this and we\u2019ll share information as the situation develops. As a Liquid BTC wallet, Liquid functionality in Aqua Bitcoin is impacted, but Bitcoin transactions will still work normally. These are difficult times but we\u2019ll pull through.\u201d<\/p>\n<\/blockquote>\n<h2>Liquid Exploit Puts Sidechain Security Under the Microscope<\/h2>\n<p>2026 has been a hell of a year for exploits and hacks, and this incident just throws salt on the wounds. It also focuses on sidechains, bridges, technical bugs, and governance fragility as well. The fact is, a well known federated sidechain pausing for manual intervention is a pretty big deal, and it\u2019s quite unusual. Especially a product crafted by a BTC firm with a $3.2 billion valuation. It\u2019s safe to say that with all of these exploits in the crypto space, like <a href=\"https:\/\/news.bitcoin.com\/security\/coldcard-hack-116-million-fourth-wave\/\">the recent Coldcard firmware bug<\/a>, confidence is eroding.<\/p>\n<p>Alongside this, artificial intelligence (AI) or Large Language Models (LLMs) are being accused once again of finding this specific exploit, despite the fact that Blockstream has not said how this bug was discovered. People are still speculating. At the same time, while LLMs are powerful pattern-matchers and can catch vulnerabilities, a case like this likely required deep, contextual protocol intuition. Meaning, while the AI probably helped, a human definitely pulled the trigger.<\/p>\n<\/p><\/div>\n<p><a href=\"https:\/\/news.bitcoin.com\/crypto-news\/blockstream-hunts-white-hats-after-4000-btc-leaves-liquid\/\">Source link <\/a><br \/>\n<br \/><\/p>\n","protected":false},"excerpt":{"rendered":"<p>(Originally posted on : Bitcoin News ) Key Takeaways Blockstream paused the Liquid network layer two (L2) after roughly 4,000 BTC, worth $320 million, was withdrawn by so-called white hat hackers on Sept. 6. Sideswap\u2019s Elements bug raises new security concerns after 3,996 BTC cleared its peg-out service. Blockstream explained that it is in the [&hellip;]<\/p>\n","protected":false},"author":19,"featured_media":77816,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0},"categories":[32],"tags":[],"_links":{"self":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts\/77815"}],"collection":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/users\/19"}],"replies":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/comments?post=77815"}],"version-history":[{"count":0,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts\/77815\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/media\/77816"}],"wp:attachment":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/media?parent=77815"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/categories?post=77815"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/tags?post=77815"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}