Liquid Network Says ‘White Hats’ Removed About 4,000 BTC From Its Federation Wallet

Liquid Network says a security incident has pulled roughly 4,000 bitcoin out of its federation wallet, with the people behind the transaction describing themselves as white hats.

At the value cited by the network, that is about $320 million. The label does not settle what happened, who controlled the transaction, or whether the bitcoin will be returned.

It does, however, put an unusually large amount of Bitcoin at the center of an active recovery effort.

In its first public account, Liquid Network said Blockstream was working to contact the actors on-chain with a signed message. That detail matters because a signed message can establish that a communication comes from a party controlling a particular Bitcoin key without requiring the party to reveal the key itself.

Here is Liquid Network’s initial incident notice:

We are aware of a security incident on @Liquid_BTC. Purported white-hat hackers have withdrawn ~4,000 BTC (~$320 million) from the Liquid Federation wallet. The @Blockstream team is working on contacting them on-chain with a signed message.

What we know so far is that the funds…

— Liquid Network 🌊 (@Liquid_BTC) September 6, 2026

Liquid is a Bitcoin sidechain designed to move bitcoin-linked value more quickly and privately between participating platforms. Bitcoin represented on Liquid is secured through a federation model rather than by Bitcoin’s ordinary proof-of-work settlement alone.

That design is why the phrase “federation wallet” is central to this story. The immediate question is not whether Bitcoin’s base-layer consensus failed.

It is how assets controlled through Liquid’s federation moved, what authority was used, and whether the actors will cooperate with recovery.

Cointelegraph identified the incident as one of the week’s biggest Bitcoin developments. But the public record was still developing Sunday night, and the network had not yet published a full technical postmortem explaining the path into the wallet or the safeguards that did and did not work.

That leaves several points unresolved: whether the actors can prove a defensive purpose, whether every coin remains under their control, what conditions they may demand, and how quickly normal Liquid services can be restored. Until those facts arrive, “white hat” should be treated as the actors’ claim, not a final finding.

Samson Mow, a longtime Bitcoin executive who said teams were actively working on the incident, drew a useful boundary around the disruption. He said Liquid functionality in Aqua Wallet was affected while ordinary Bitcoin transactions in the wallet continued to work.

His update helps distinguish an incident involving Liquid infrastructure from a failure of Bitcoin itself:

Everyone is actively working to resolve this and we'll share information as the situation develops. As a @Liquid_BTC wallet, Liquid functionality in @AquaBitcoin is impacted, but Bitcoin transactions will still work normally.

These are difficult times but we'll pull through. 🙏 https://t.co/QFqCJuEfaJ

— Samson Mow (@Excellion) September 6, 2026

For users, the practical move is to follow official service notices and avoid anyone offering recovery help through direct messages. A live incident involving hundreds of millions of dollars is exactly the environment in which impersonators and follow-on scams appear.

For the wider market, the next meaningful update will not be a label. It will be verifiable movement of the bitcoin, a signed communication from the controlling keys, a clear restoration timeline, or a technical explanation from Liquid and Blockstream.

Those are the facts that can show whether this ends as a coordinated return or becomes one of the largest Bitcoin-linked security losses on record.

Join the conversation!

We have no tolerance for comments containing violence, racism, profanity, vulgarity, doxing, or discourteous behavior. If a comment is spam, instead of replying to it please click the icon below and to the right of that comment. Thank you for partnering with us to maintain fruitful conversation.