Liquid Network, a Bitcoin sidechain built for fast and confidential settlement, disclosed on September 7 that roughly $320 million in bitcoin had been withdrawn from its federation-controlled wallet without authorization. Within hours, an anonymous party claiming to be a white hat hacker said they had taken 4,000 BTC from the network and intended to give it back. The episode counts among the largest security events involving Bitcoin-adjacent infrastructure this year, and it landed while US spot bitcoin ETFs were posting their strongest inflow weeks of 2026.
What happened on the Liquid Network
Liquid is a federated sidechain operated by a group of exchanges and financial firms. Unlike the Bitcoin mainnet, its blocks are produced every minute by a federation of functionaries, and assets moving onto the chain are held in a multisig-controlled wallet that the federation governs. That design is what makes Liquid fast and private, and it is also what turned a single compromise into a nine-figure event.
According to a summary of the incident published by CoinStats, approximately $320 million had been withdrawn from the federation wallet on September 7 in what the network described as a hack. The company’s own reporting notes that the withdrawal did not halt trading or flows elsewhere in the market, and that the event has not been identified as the direct cause of bitcoin’s broader slide below $80,000 earlier this week.
The scale matters. A $320 million draw from a federation wallet is larger than most exchange hacks recorded in 2026, and it touched infrastructure that several major trading desks use for settlement between venues. Liquid’s peg mechanism means bitcoin on the sidechain is backed by reserves on the mainnet, so any unexplained movement of those reserves raises immediate questions about whether the peg remains fully covered.
The white hat claim
Hours after the withdrawal became public, an unknown party claimed responsibility, framing the takeover of 4,000 BTC as a white hat operation. Cointelegraph’s weekly roundup described the claim as purported, which is the right word: nobody has independently verified who controls the coins or what their intentions are.
“Purported white hat hackers have taken 4000 Bitcoin from the Liquid sidechain in a major security breach,” Cointelegraph reported in its Hodler’s Digest on September 9.
White hat claims are a familiar pattern in crypto security incidents. In past cases, ranging from the Munchables exploit on Blast to several smaller 2025 incidents, self-described white hats returned funds after negotiations, sometimes in exchange for a bounty, and sometimes under pressure from tracing firms and exchanges prepared to freeze deposits. In other cases, the claim was cover for ordinary theft. Until coins move back to a federation-controlled address, the claim should be treated as an assertion, not a resolution.
The 4,000 BTC figure itself is telling. At recent prices near $78,000 to $79,000, 4,000 BTC is worth roughly $315 million, which lines up closely with the $320 million withdrawal the network reported. That consistency suggests the claimant is describing the same transaction the network flagged, whether the motive is genuine or not.
Why the federation design is the story
Liquid launched in 2018 as a Blockstream-led project with a simple pitch: faster blocks, confidential transactions, and issued assets, secured not by miners but by a federation of reputable institutions. Fifteen exchanges and financial firms signed on as functionaries in the first round, and the roster has shifted over the years but kept the same shape.
The tradeoff was always clear to anyone reading the documentation. A federation removes the need for proof-of-work finality and enables features Bitcoin’s mainnet cannot offer, but it concentrates trust in a small set of keyholders. If enough functionary keys are compromised, or if the software governing the wallet can be manipulated, the entire peg is exposed. This week’s incident is a live demonstration of that tradeoff at scale.
It also arrives at a delicate moment for sidechains and layer-2 designs generally. Bitcoin’s ecosystem has spent 2025 and 2026 building out rollups, sidechains, and pegged-asset bridges, each of which inherits some version of the same problem: someone or something has to hold the keys that connect the layer back to mainnet. Liquid holds roughly a tenth of the value that newer Bitcoin L2 projects aspire to, so the post-mortem here will be studied well beyond the federation’s own members.
| Item | Detail |
|---|---|
| Network affected | Liquid Network, Bitcoin federated sidechain |
| Date disclosed | September 7, 2026 |
| Amount withdrawn | Approximately $320 million in BTC |
| White hat claim | 4,000 BTC taken, stated intent to return |
| Market impact | No direct move attributed; BTC fell below $80,000 on macro factors |
| Wallet type | Federation multisig |
How the market absorbed it
The striking part of the week is how little the incident moved prices. Bitcoin traded near $77,900 on September 3 after a single-day ETF outflow of about $236.5 million, per Farside Investors data, then recovered into the $78,000 to $79,000 range through September 8 and 9. Liquidations in bitcoin futures over the 24 hours through September 9 totaled about $33.5 million, with longs bearing 84 percent of that, modest figures by the standards of a market that regularly clears $500 million in a bad session.
Sentiment indicators stayed greedy rather than fearful. The Fear and Greed Index sat in the low 70s even after the Liquid disclosure, and funding rates across major perpetual venues remained positive but moderate. Traders appear to have filed the hack under infrastructure risk rather than systemic risk, a reading that would have been harder to sustain if a major exchange’s hot wallet had been drained instead of a sidechain’s federation.
There is a second reason the market shrugged. Institutional demand has been running hot. US spot bitcoin ETFs pulled in roughly $986.9 million in the week ended September 4, up from about $924.5 million the prior week, according to SoSoValue data cited by CoinStats. Strategy, the largest corporate holder, disclosed the purchase of 4,603 BTC for approximately $369.7 million during the week of August 24 to 30, its first large buy after a ten-week pause, at an average price of $80,318 per coin.
The irony of timing
The incident lands in the same stretch as the strongest institutional accumulation of 2026, and the contrast is hard to miss. Asset managers are buying bitcoin through regulated fund wrappers at a pace the market has not seen all year, while a ten-year-old piece of Bitcoin infrastructure loses a third of a billion dollars from its core wallet in a single event. Both facts describe the same market.
CoinDesk noted ahead of the week that bitcoin ETFs were still about $1 billion short of breaking even on the year, which puts the August and early September inflow surge in context: the recovery is real but shallow. A security event that erodes confidence in self-custody alternatives could, perversely, push more conservative allocators toward the ETF structure, where custody sits with Coinbase Custody and similar regulated providers rather than with a federation’s multisig.
That reading is speculative. What is not speculative is that the incident will feature in every custody debate for the next quarter. Insured vault products such as the one CoinCorner launched with Lloyd’s-backed coverage earlier this month, and the multisig arrangements exchanges promote to institutions, will now be benchmarked against a $320 million data point.
What happens next
Three things to watch. First, whether the coins move. Federation addresses are watchable in real time, and any transfer of the 4,000 BTC back toward federation control will be visible within minutes of it happening. Second, the official post-mortem. Liquid’s functionaries have an obligation to explain how the withdrawal cleared a multisig threshold, whether a keyholder was compromised, and what changes to the quorum or signing process follow. Third, whether the claimant negotiates publicly. Bounties and return deadlines tend to surface on-chain as messages embedded in transactions.
For now the peg appears intact in the sense that markets continue to price L-BTC near parity, but the deeper question is whether federation members will trust the current key arrangement going forward. A re-key of the federation, or a shift of reserves to cold storage with slower withdrawal processing, is a plausible near-term outcome either way.
The episode also hands ammunition to critics who have long argued that Bitcoin’s layer-2 boom repeats the trust models the mainnet was designed to remove. Supporters will answer that Ethereum’s bridges lost billions to similar failures in 2022 and the ecosystem adapted. Both camps are right about something, and the next few weeks of post-mortem detail will decide which lesson dominates.
discussion