Liquid Network hack: how Blockstream's Bitcoin sidechain lost 4,000 BTC

01 — The message"we are whitehats. contact us on chain"

Late on Sunday afternoon UTC a Bitcoin tx confirmed that spent two coins back to the same wallet, one of them the whole peg-out, and sent 1,000 sats to the federation's peg wallet. Wedged between those outputs was an OP_RETURN, the small field where anyone can write a note into a block. The note read: "we are whitehats. contact us on chain".

The on-chain sleuth ErgoBTC had already seen it in the mempool seven minutes earlier and posted the question everyone was about to ask: "Liquid got got?"

Four hours before that, the federation had signed away 3,996 BTC in a single peg-out, more than nine tenths of all it held. Nothing about the tx looked forced. Eleven of the fifteen functionaries signed it, the way they sign every peg-out. The request came through SideSwap, a Liquid member whose peg-out key is on the whitelist. Every key did exactly what it was built to do, and the bitcoin left anyway.

02 — The premiseWhat Liquid is, and what a peg-out means

Liquid is a Bitcoin sidechain built by Blockstream. You lock bitcoin in the federation's multisig on the main chain, a peg-in, and the same amount of L-BTC appears on Liquid, where blocks arrive every minute and amounts are hidden by confidential transactions. Send L-BTC back to the peg, a peg-out, and the federation releases the bitcoin. Fifteen companies run the functionary boxes that sign blocks and hold the keys, and any 11 of them can move the bitcoin. Exchanges use Liquid to settle with each other, Tether issues USDT on it, and a handful of firms run peg-in and peg-out desks for anyone who does not want to deal with the federation directly. SideSwap is one of those desks. It charges 0.1 percent.

The promise under all of that is short. There is never more L-BTC than there is bitcoin in the peg wallet. On Saturday the wallet was full. By Sunday evening it was nearly empty.

Bitquery indexes the whole Bitcoin chain, and the Liquid chain is public too, so we did not have to take anybody's word for what happened. We pulled every tx the whitehat wallets made on both chains, rebuilt the peg-out from the federation's side, and read the messages both parties wrote into blocks, checking Blockstream's PGP sigs against its own key. What follows is that record: where the L-BTC came from, how it left, what the two sides have said to each other, and what Liquid looks like while it waits. One limit belongs up front. Amounts on Liquid are hidden and Blockstream has not named the bug, so the mint itself can be found in the record but not fully explained by it.

03 — The rehearsalTwo bitcoin in, a day of practice

The wallet that would drain the peg started with about 2 BTC of its own. Two peg-ins on the Friday, a little over a bitcoin each, arrived on Liquid as L-BTC by Saturday morning. Both were funded from a pile of small taproot coins, 24 in one and 39 in the other, which reads like a wallet that had been stacking sats for a while rather than a fresh CEX withdrawal. None of the funding wallets carries a label in our database or in MetaSleuth's.

Then the wallet went to work. From Saturday lunchtime UTC until Sunday afternoon it hopped through dozens of fresh addresses, then settled on two and made 92 txs from them on Liquid. Most were tiny: one input, three outputs, a 41-sat fee. They came in bursts, with a lull over night and a final short run around noon on Sunday. Anyone watching the mempool would have seen a busy wallet doing nothing much.

Seventy of those txs had one thing in common that ordinary wallets never produce. Each carried an OP_RETURN output with the asset written in plain, L-BTC, but the amount hidden. And 68 of them carried the same hidden amount and the same range proof, byte for byte, dropped into blocks across 14 hours.

Confidential transactions lean on range proofs. A hidden amount is fine as long as a proof shows it is not negative, because a negative output is how you print money. Nodes check thousands of these proofs and cache the ones they have already passed, so they do not do the work twice. Planting one proof 68 times over 14 hours looks like an effort to make sure every node on the network had that exact proof sitting in its cache. What the wallet then did with it is the one step the public record does not show.

04 — The exitOne transaction on Liquid, one on Bitcoin

The wallet ran three dry runs before the real thing: small peg-outs through SideSwap on Sunday morning UTC. Those were real L-BTC, or at least the federation treated them that way, and they proved the route worked end to end. SideSwap's payouts from all three were gathered into one coin of about 2.5 BTC and sent to a fresh Bitcoin address just after 14:00 UTC. That address is the one now holding all of it.

The mint came at 13:53 UTC, in a Liquid tx with one input, three outputs and a fee of 58 sats. It is the only tx in the wallet's whole history whose range proof is a different length from every other one it made. Both spendable outputs went to SideSwap within seven minutes. SideSwap swept them into its hot wallet, and its peg-out desk asked the federation for the full amount, plus a second, smaller peg-out for its own fee.

Then the federation paid, in one big tx that pulled together most of the coins the peg wallet had. The fee was pocket change.

In the same block SideSwap forwarded the customer's bitcoin, less its fee, to the address that had taken the dry-run payout half an hour earlier. The federation processed two more small peg-outs that afternoon before the bridge was switched off. That is how the peg wallet arrived at the balance it holds now.

05 — The conversationTwenty-six messages, and counting

Most hackers who want to talk open a Telegram account. This one wrote into Bitcoin, and Blockstream, after one short public note, decided to answer there too. Every message is a tx that pays 1,000 sats to the other side and carries the text in an OP_RETURN. We decoded all of them from the raw blocks and checked every Blockstream signature against its published key; three of the 26 are copies of one message. From Monday the talk went private: Blockstream locks its notes to the key behind the whitehat's address and the whitehat locks its own to the PGP key. On Tuesday afternoon the whitehat announced it was going back to plain text, and on Wednesday it used it.

Three details in the raw txs say more than the words. Blockstream's first reply came from a fresh address funded out of a two-key wallet with a long recovery timeout, the same form Blockstream's own Green wallet uses. Its second message was encrypted to the public key the whitehat had exposed by spending, in the Electrum ECIES format, and signed with the key whose fingerprint ends 6844 A2D6. We fetched that key from blockstream.com, imported it, and both sigs verify against "Blockstream Security Reporting". Change one character of either text and the check fails.

The whitehat's txs carry a tell of their own. Each sets a locktime just below the current height, the anti-fee-sniping habit of Bitcoin Core's wallet family, and each sweeps up every scrap of dust that others had sent to the address since the last message. That is why the second message has 15 inputs. By the time of the third, two dozen dust payments had arrived from outsiders wanting to be read: a Signal handle, a New York lawyer offering pro bono help with "a clean return", a wallet app plugging itself four times, a Monero swap desk promising no freezes, a second swap site openly pitching itself for laundering, and a memecoin. The whitehat spent all of it as fee change.

Not everyone reads the label the wallet gave itself. Charles Guillemet, Ledger's CTO, wrote on X that draining a bridge and then asking for on-chain contact "doesn't look like usual white hats practices". He added that criminal crews do not usually try to contact their victims either, and floated the idea of "people with good intentions that intensively played with recent LLMs and are not used to responsible disclosures".

06 — The bugTwo hashes that ran together

SideSwap said within hours that "the L-BTC came from an Elements bug, not from any SideSwap system", and Liquid said no key was compromised. Elements is the open-source software every Liquid node runs. Neither company has named the bug even now. But on Wednesday morning Blockstream shipped an emergency release, and what it changes is the same corner of the code the 68 planted outputs were aimed at.

Here is what the cache does. Checking a range proof is slow, so a node that has passed one writes a short key into a table and skips the work next time the same thing turns up. The key was built by gluing four values end to end and hashing the result: the proof, the hidden amount, the hidden asset, and the output script. Nothing marked where one value stopped and the next began. Two different sets of four can therefore glue into the same bytes, land on the same key, and the second set is waved through on the strength of the first. The new code writes the length of each value before the value, which ends that.

The whitehat had said on Sunday morning that the chain was "under risk at latest commit right now". That reads as a complaint that the August fix was not enough, and the August fix is the one that added the asset and the script to the key without separating them. The new tests in the release cover, in the words of the pull request, "field-boundary collisions". Blockstream has published no post-mortem and named no bug, so a patch is all there is to read. But a node that can be handed a proof it never checked is how you print money on a chain where amounts are hidden, and planting one proof 68 times is how you make sure every node holds the first half of the pair.

07 — Where it standsMost of the money is back, the chain is not

Liquid announced on Sunday evening that its bridge nodes were off and the chain was "effectively paused", and asked CEXs to stop L-BTC deposits and withdrawals. Blocks kept coming every minute at first, because the signers still made them, but nothing went in. User txs fell from about 190 an hour on Sunday afternoon to two in the hour after midnight, and none since one in the morning UTC on Monday. Then, at 04:49 on Monday, the blocks stopped too. They have not restarted since. More than two days later Blockstream's own node still shows block 4,051,232 as the tip, with 336 txs waiting in its mempool.

On Monday the bitcoin moved. One tx from the whitehat address, 15 inputs, two outputs: 3,400 BTC to the peg wallet and the rest back to itself. It landed at 16:09 UTC, nearly seven hours after Blockstream first wrote that its bridge nodes were patched, and in the middle of a run of coded notes between the two sides. What the whitehat kept, 598.5 BTC, is about 15 percent of what was taken and roughly $48 million at Monday's price. Neither side has said in the open whether that was agreed. The whitehat's only plain words afterwards were a sad face.

The peg wallet now holds about 3,601 BTC, the 3,597 from the return plus 4 BTC that arrived on Wednesday morning from coins we could not tie to either side. Set that against roughly 4,200 honest L-BTC still out in CEX accounts and wallets, so each L-BTC is backed by about 86 cents of bitcoin rather than a dollar. That gap is the 598.5 BTC the whitehat kept plus SideSwap's fee and the dry runs, and somebody will have to fill it before the peg is whole. Tether's USDT on Liquid and the other issued assets are not touched by this, because they were never backed by the peg wallet in the first place.

08 — What we are watchingOpen threads

"Most" turned out to mean 85 percent, and on Wednesday the whitehat said in the clear what the coded notes had been about. It wants Blockstream to pay a bounty of 10 percent out of its own pocket, which set against the 15 percent it holds reads as about 400 BTC. If not, it says, the 15 percent it is sitting on becomes a loss for everyone holding L-BTC. It has also promised to publish the key that unlocks the whole coded exchange, which would put both sides of a live negotiation in public. Blockstream has answered every message and said nothing in the open. Blockstream has now shipped the patched release and still said nothing in public about the bug itself. Liquid has not restarted. The three dry-run peg-outs and SideSwap's fee are real bitcoin paid for L-BTC that never existed, and they sit on the same side of the ledger as the 598.5. And Elements runs more than Liquid. Every sidechain on the same code had the same hole on Sunday, and each one now has a release to take.

We are re-reading both wallets as blocks arrive and will add each new message, and the restart of Liquid when it comes, to the log at the top of this piece.

Anyone who wants to check a number here can pull the same records. We took the same route through the Coldcard theft, the Aquifer drain on Solana and the $120 million Tectonic exploit, and the OP_RETURN habit that carried this negotiation is the subject of what people write into Bitcoin blocks. Teams that do this work under a mandate use our crypto investigation services and the money flow tools behind them.