{"id":77891,"date":"2026-09-08T17:01:44","date_gmt":"2026-09-08T17:01:44","guid":{"rendered":"https:\/\/crowdfundjunction.com\/blog\/blockstream-hackers-turn-bitcoin-into-a-wild-onchain-message-board-bitcoin-news\/"},"modified":"2026-09-08T17:01:44","modified_gmt":"2026-09-08T17:01:44","slug":"blockstream-hackers-turn-bitcoin-into-a-wild-onchain-message-board-bitcoin-news","status":"publish","type":"post","link":"https:\/\/crowdfundjunction.com\/blog\/blockstream-hackers-turn-bitcoin-into-a-wild-onchain-message-board-bitcoin-news\/","title":{"rendered":"Blockstream Hackers Turn Bitcoin Into a Wild Onchain Message Board \u2013 Bitcoin News"},"content":{"rendered":"<p><b>(Originally posted on : Bitcoin News )<\/b><br \/>\n<\/p>\n<div>\n<div class=\"@container mb-[25px] rounded-sm overflow-clip py-0.5 pr-0.5 pl-2.5 bg-success-100\">\n<div class=\"flex flex-col gap-m overflow-clip rounded-[6px] !bg-success-10 p-3 @[420px]:p-m\">\n<h2 class=\"m-0 flex items-center gap-s text-[19px] !text-[#1c1c1c] md:text-[20px]\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"16\" height=\"10\" viewbox=\"0 0 16 10\" fill=\"none\" class=\"shrink-0 text-success-100\" aria-hidden=\"true\"><path d=\"M1 1.5h14\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\"\/><path d=\"M1 8.5h10\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\"\/><\/svg><span>Key Takeaways<\/span><\/h2>\n<ul class=\"m-0 flex list-none flex-col gap-m pl-0\">\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">Liquid Network got hit for nearly 4,000 BTC, but the white hats sent 3,400 BTC back on Monday.<\/span><\/li>\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">Bitcoin\u2019s blockchain got pretty noisy after the Sept. 6 exploit, with dust messages, meme coin shills and scams piling in.<\/span><\/li>\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">Blockstream is still talking with the hackers, while 598.49 BTC remains in the hacker\u2019s hands.<\/span><\/li>\n<\/ul>\n<\/div>\n<\/div>\n<h2>Hackers Tell Blockstream to \u2018Contact Us\u2019 Onchain<\/h2>\n<p>It all started this weekend on Sept. 6, <a href=\"https:\/\/news.bitcoin.com\/security\/we-are-whitehats-nearly-4000-btc-drained-from-blockstreams-liquid-peg\/\">when purported white hack hackers drained reserves<\/a> from the Liquid Network\u2019s L-BTC reserves. They came with a message \u201cwe are whitehats. contact us on chain\u201d sent in an OP_RETURN transaction. The Bitcoin blockchain allows users to attach a public note to a payment, and during the discussion, both sides have sent each other almost-worthless amounts of bitcoin with short messages to each other.<\/p>\n<p>Blockstream initially replied by saying \u201cPlease contact security@blockstream.com,\u201d and sent another message with encrypted text that had a detached PGP signature from security@blockstream.com, and this message cannot be read. The self-described white hats then replied back:<\/p>\n<blockquote>\n<p>\u201csending most back to bc1qd\u2026., is that ok\u201d<\/p>\n<\/blockquote>\n<h2>3,400 BTC Returned While 598.49 BTC Remains With White Hats<\/h2>\n<p>It is assumed that the white hats privately provided additional details about the vulnerability. A series of encrypted, PGP-signed messages followed between the two sides. At 16:09 UTC, <a href=\"https:\/\/news.bitcoin.com\/security\/liquid-hackers-return-3400-btc-keep-47m-as-network-stays-frozen\/\">the group returned 3,400 BTC<\/a> to the federation wallet while retaining 598.49 BTC. It\u2019s pretty difficult to follow the onchain discussion using a blockchain explorer like mempool.space, as a large swarm of BTC users <a href=\"https:\/\/mempool.space\/address\/bc1ql4mfu6aundtkksxklfajs2h3t9nzcd6gyqjlte\" target=\"_blank\" rel=\"noopener noreferrer\">are sending dust to the wallet<\/a> with their own unique messages.<\/p>\n<h2>Meme Coin Scammers, Pleas and Other Scams Flood the Onchain Conversation<\/h2>\n<p>Some messengers shilled their meme coins dubbed \u201cWHITE HAT\u201d in onchain messages sharing Pump.fun URL links and Solana addresses. Others begged for money and said they needed funds because they were out of work or for an alleged sick family member. Others described ways to launder the BTC through mixing services and using <a href=\"https:\/\/news.bitcoin.com\/altcoins\/zcash-and-moneros-price-rip-higher-as-privacy-coin-markets-roar\/\">the privacy-centric Monero blockchain<\/a>. Some messages used scam tactics like shady doubler-schemes and told people to send BTC in order to \u201cdouble their coin.\u201d<\/p>\n<figure id=\"attachment_845978\" aria-describedby=\"caption-attachment-845978\" style=\"width:2350px\" class=\"wp-caption aligncenter\"><figcaption id=\"caption-attachment-845978\" class=\"wp-caption-text\">Image source: Hacker address showing the onchain message of one person asking for a 10 BTC donation.<\/figcaption><\/figure>\n<p>Doubler-schemes are always are always fraudlent. \u201cPlease gift 8.5 BTC,\u201d one user begged. \u201cNo more. No less,\u201d the individual\u2019s OP_RETURN message said. \u201cI wish for 0.1 BTC for my crypto journey,\u201d another messenger asked the white hats. \u201cRight now, 10 BTC is pennies to you,\u201d another said, insisting that 10 BTC would be \u201ceverything\u201d to them. The amount of BTC dust used to send countless messages to the white hats is pretty incredible, and a great majority of them were meme coin shills.<\/p>\n<h2>Nearly 600 BTC Still Held as Liquid Network Remains Frozen<\/h2>\n<p>It is still unknown why the so-called white hats have kept nearly 600 BTC, and on social media, many are saying that this undermines any genuine \u201cwhite hat\u201d justification. At the same time, the ensuing onchain noise from dust messages is still filling up with meme coin shillers, desperate pleas, and ongoing scam pitches. At the time of writing at 10:30 a.m., the Liquid Network is still frozen, and the conversation between <a href=\"https:\/\/news.bitcoin.com\/crypto-news\/blockstream-hunts-white-hats-after-4000-btc-leaves-liquid\/\">the L2 operator Blockstream<\/a> and the hackers continues.<\/p>\n<\/p><\/div>\n<p><a href=\"https:\/\/news.bitcoin.com\/crypto-news\/blockstream-hackers-turn-bitcoin-into-a-wild-onchain-message-board\/\">Source link <\/a><br \/>\n<br \/><\/p>\n","protected":false},"excerpt":{"rendered":"<p>(Originally posted on : Bitcoin News ) Key Takeaways Liquid Network got hit for nearly 4,000 BTC, but the white hats sent 3,400 BTC back on Monday. Bitcoin\u2019s blockchain got pretty noisy after the Sept. 6 exploit, with dust messages, meme coin shills and scams piling in. Blockstream is still talking with the hackers, while [&hellip;]<\/p>\n","protected":false},"author":19,"featured_media":77892,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0},"categories":[32],"tags":[],"_links":{"self":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts\/77891"}],"collection":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/users\/19"}],"replies":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/comments?post=77891"}],"version-history":[{"count":0,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts\/77891\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/media\/77892"}],"wp:attachment":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/media?parent=77891"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/categories?post=77891"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/tags?post=77891"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}