Liquid's Federation Drained
A relentless wave of DeFi exploits—spanning bridge hacks, oracle manipulation, governance attacks, and AI-accelerated vectors—is draining billions and setting record loss milestones across 2026.
Roughly 4,000 BTC — reports range from 3,998 to 4,200 coins, around $318–320 million — left the federation wallet securing Blockstream's Liquid Network, after which the sidechain was paused, per multiple outlets. The parties left an on-chain message claiming whitehat motivation, which Ledger's CTO publicly disputed; commentary separately cited a potentially stale functionary codebase as a contributing factor. Under Liquid's peg-out design the corresponding Liquid Bitcoin is burned before real coins release, and no user balances were reported unbacked at the time of coverage.
Liquid Drain: Eleven Agreed. Or Eleven Were Made To.
Bitcoin is slow by design. Every payment is public forever.
Liquid is a faster side network built by Blockstream, used mainly by traders and exchanges.
Transfers confirm in a minute. Amounts can be hidden.
To use it, you lock real Bitcoin into a vault. You get Liquid Bitcoin on the side network, one for one.
To leave, you do the reverse. Your Liquid Bitcoin is destroyed, and the vault releases your real coins.
Who controls the vault? Fifteen chosen operators. Eleven must sign to release coins.
Their machines sign automatically whenever the rulebook's condition is met: Liquid Bitcoin destroyed, real coins out.
Roughly $320 million sat in that vault.
This week, nearly all of it left in a single transaction.
Here is the part still unexplained.
The rules were followed. Liquid Bitcoin was burned. Nothing is unbacked.
So whoever did this controlled roughly $320 million of Liquid Bitcoin.
Your Liquid coins, in your wallet, were not touched. This wasn't picking pockets.
Either someone legitimately amassed that much — possible, for the desks Liquid serves.
Or someone broke the machinery deep enough to conjure it.
A note left on-chain claims rescue. Ledger's chief technologist doubts it.
But eleven machines signed. Or eleven machines were made to.
The moment your coins live behind a handful of keys, you're back to trusting people.
Multi-media snippets
7 sources
- Ledger CTO questions “whitehat” claim after $318 million Liquid Network BTC peg-out · en.coin-turk.com · T2
- Uh, yikes, if you’re storing any value on Liquid be cautious… · x.com · T2
- Attackers Leave On-chain Message After $320 Million Exits Liquid Network · beincrypto.com · T2
- Alleged White-Hat Hackers Withdraw 4,000 bitcoin from Blockstream’s Liquid Network Federation Reserves · bitcoinmagazine.com · T2
- White hat hacker drains ~4,200 BTC from Liquid Network, worth $320M · cryptobriefing.com · T2
- I seriously doubt it's a coincidence that the Liquid bridge got drained just a couple… · x.com · T2
- Liquid Sidechain Paused After 3,998 BTC Leaves Federation Wallet · thedefiant.io · T2
