đź’§ Looting of Liquid Sidechain Underscores Emerging Cyber Threat to Bitcoin
This article originally appeared in Galaxy Research's weekly newsletter. Subscribe to get timely insights delivered to your inbox every Friday morning.
Liquid Network, a Bitcoin sidechain, had 4,000 BTC stolen by self-described “white hat” hackers, but the attackers have only returned 85% of funds.
On Sunday, hackers siphoned 4,000 BTC (~$320m) from the Liquid Federation, the entities that produce blocks on the federated sidechain and which control peg-in and peg-out to move BTC to and from the sidechain (essentially a bridge in broader crypto lingo). After receiving the 4,000 BTC from federation member and peg-out service Sideswap, the hackers consolidated the funds into their holding address and included a line of text in the OP_RETURN field that said “we are whitehats. contact us on chain.”
Eventually, the main developer behind the Liquid Network codebase, Blockstream, began communicating with the hackers onchain, also via the OP_RETURN field. After some back and forth, the hackers returned 3,400 BTC (85%) to the Liquid Federation.
Blockstream and the hackers began communicating via encrypted text in the OP_RETURN fields, with Blockstream encrypting its messages to the hackers’ bitcoin address and the hackers encrypting their responses using Blockstream’s publicly published PGP key. However, the remaining 15% (600 BTC) still sits in the hackers’ address and by midweek it appeared that negotiations had broken down, with the hackers sending this message in plaintext on Sep. 9 (directed at Blockstream):
Your dereliction of duty is obvious that you allocated $1.5M (maybe even 0) to secure $5B of assets. This is a flagrant neglect of security and a sign of complete mismanagement. You SHALL pay 10% using your own money as bug bounty or you will cause all your holders a 15% loss for your irresponsibility and stinginess. Even companies that participate in bug bounty programs cannot guarantee complete security, let alone one like yours that remains delusional, greedy, and arrogant to this very day. Anyway we are going to publish the privatekey [sic] to decrypt our conversations afterwards.
Blockstream and the hackers have sent a total of 28 messages in four days. With so many eyes on the hacker address, dozens of other messages have been sent to the hacker, ranging from pleas to return funds, to offers of legal representation, to memecoin advertisements, general spam and vulgarity. The hackers’ address received more human-readable OP_RETURN posts in 1 day than Satoshi’s Genesis Block has received in 10 years.
The original theft was conducted by exploiting a vulnerability in the sidechain node code which allowed the hackers to artificially create 4,000 L-BTC (the Liquid version of wrapped BTC). They were then able to request a valid peg-out from the sidechain back onto the main Bitcoin blockchain. Even though withdraw addresses must be whitelisted, Liquid Federation member SideSwap had been offering an auto-forward service where any entity could withdraw to SideSwap’s own whitelisted address and then it would automatically forward the funds to the withdraw requestor.
Our take
If you take funds and refuse to return them, you are a not a “white hat.” Indeed, the proper method to perform white hat activities is to responsibly and securely disclose the vulnerability to developers. The only time it makes sense to proactively conduct a hack and then attempt to return funds is if the risk of discovery is so high that a black hat could steal them first. Whether or not that was the case with Liquid, the vulnerability was one that could have been disclosed to and patched by Blockstream, unlike the Coldcard vulnerability, which could not be remotely patched. (Real white hats have announced they were able to "steal" 50 BTC from Coldcard victims, have placed the assets in a Wyoming trust, and are looking to return all funds to their rightful owners.) Holding 15% of the stolen funds ransom while you negotiate to keep them is effectively extortion (a crime), not white hat behavior.
The self-described white hats’ Sept. 9 message shows their frustration with Blockstream (we can’t see the content of Blockstream’s messages because they are all encrypted to the hackers’ key) and explicitly demands Blockstream pay a 10% bounty (340 BTC, worth ~$26m) from its own funds; if Blockstream doesn’t pay, the hackers suggest they’ll keep the 15% remaining of the Liquid Network’s funds (coins that presumably belong to Liquid Network users). Whether the hackers are frustrated with Blockstream solely from their back-and-forth, or harbored animosity to the firm prior to the exploit, is a matter of conjecture.
While the Coldcard exploit was particularly devastating primarily because of the victim demographic (long-term believers stacking into cold storage), Liquid itself isn’t systemically important to the Bitcoin ecosystem. That said, it is the latest in several high profile BTC thefts – Coldcard, BTCPay Server, now Liquid – that have the Bitcoin community dealing with cyber thefts that usually happen on other, more expressive blockchains. The simplicity of Bitcoin’s coding language and limited programmability have historically helped limit its onchain attack surface when compared to general-purpose smart-contract blockchains like Ethereum and Solana.
Many speculate, of course, that the hackers identified and exploited the vulnerability with assistance from AI. The urgency to harden codebases across Bitcoin and crypto is only rising as the clanker wars continue.
Legal Disclosure:
This document, and the information contained herein, has been provided to you by Galaxy Digital Inc. and its affiliates (“Galaxy Digital”) solely for informational purposes. This document may not be reproduced or redistributed in whole or in part, in any format, without the express written approval of Galaxy Digital. Neither the information, nor any opinion contained in this document, constitutes an offer to buy or sell, or a solicitation of an offer to buy or sell, any advisory services, securities, futures, options or other financial instruments or to participate in any advisory services or trading strategy. Nothing contained in this document constitutes investment, legal or tax advice or is an endorsement of any of the stablecoins mentioned herein. You should make your own investigations and evaluations of the information herein. Any decisions based on information contained in this document are the sole responsibility of the reader. Readers should consult with their own advisors and rely on their independent judgement when making financial or investment decisions.
Participants, along with Galaxy Digital, may hold financial interests in certain assets referenced in this content. Galaxy Digital regularly engages in buying and selling financial instruments, including through hedging transactions, for its own proprietary accounts and on behalf of its counterparties. Galaxy Digital also provides services to vehicles that invest in various asset classes. If the value of such assets increases, those vehicles may benefit, and Galaxy Digital’s service fees may increase accordingly. The information and analysis in this communication are based on technical, fundamental, and market considerations and do not represent a formal valuation. For more information, please refer to Galaxy’s public filings and statements. Certain asset classes discussed, including digital assets, may be volatile and involve risk, and actual market outcomes may differ materially from perspectives expressed here.
For additional risks related to digital assets, please refer to the risk factors contained in filings Galaxy Digital Inc. makes with the Securities and Exchange Commission (the “SEC”) from time to time, including in its Quarterly Report on Form 10-Q for the quarter ended September 30, 2025, filed with the SEC on November 10, 2025, available at www.sec.gov.
Certain statements in this document reflect Galaxy Digital’s views, estimates, opinions or predictions (which may be based on proprietary models and assumptions, including, in particular, Galaxy Digital’s views on the current and future market for certain digital assets), and there is no guarantee that these views, estimates, opinions or predictions are currently accurate or that they will be ultimately realized. To the extent these assumptions or models are not correct or circumstances change, the actual performance may vary substantially from, and be less than, the estimates included herein. None of Galaxy Digital nor any of its affiliates, shareholders, partners, members, directors, officers, management, employees or representatives makes any representation or warranty, express or implied, as to the accuracy or completeness of any of the information or any other information (whether communicated in written or oral form) transmitted or made available to you. Each of the aforementioned parties expressly disclaims any and all liability relating to or resulting from the use of this information. Certain information contained herein (including financial information) has been obtained from published and non-published sources. Such information has not been independently verified by Galaxy Digital and, Galaxy Digital, does not assume responsibility for the accuracy of such information. Affiliates of Galaxy Digital may have owned, hedged and sold or may own, hedge and sell investments in some of the digital assets, protocols, equities, or other financial instruments discussed in this document. Affiliates of Galaxy Digital may also lend to some of the protocols discussed in this document, the underlying collateral of which could be the native token subject to liquidation in the event of a margin call or closeout. The economic result of closing out the protocol loan could directly conflict with other Galaxy affiliates that hold investments in, and support, such token. Except where otherwise indicated, the information in this document is based on matters as they exist as of the date of preparation and not as of any future date, and will not be updated or otherwise revised to reflect information that subsequently becomes available, or circumstances existing or changes occurring after the date hereof. This document provides links to other Websites that we think might be of interest to you. Please note that when you click on one of these links, you may be moving to a provider’s website that is not associated with Galaxy Digital. These linked sites and their providers are not controlled by us, and we are not responsible for the contents or the proper operation of any linked site. The inclusion of any link does not imply our endorsement or our adoption of the statements therein. We encourage you to read the terms of use and privacy statements of these linked sites as their policies may differ from ours. The foregoing does not constitute a “research report” as defined by FINRA Rule 2241 or a “debt research report” as defined by FINRA Rule 2242 and was not prepared by Galaxy Digital Partners LLC. Similarly, the foregoing does not constitute a “research report” as defined by CFTC Regulation 23.605(a)(9) and was not prepared by Galaxy Derivatives LLC. For all inquiries, please email [email protected].
©Copyright Galaxy Digital Inc. 2026. All rights reserved.