Liquid Network is investigating a significant security breach affecting its Federation wallet after almost 4,000 BTC, or $320 million, was taken out. According to the network, the funds were taken by alleged white-hat hackers, and Blockstream is attempting to contact them via an on-chain signed message. According to a further investigation by blockchain security company PeckShield, the attackers claimed to be white-hats. They invited the Liquid team to contact them on-chain, revealing that the Bitcoin had been combined into a single address.

Liquid Federation Wallet Loses 4,000 BTC

On September 6, Liquid Network announced that almost 4,000 BTC had been taken out of the Liquid Federation wallet, verifying the security breach. The sum, given the indicated worth, is equivalent to about $320 million in Bitcoin.

The people responsible for the withdrawals were referred to by the network as "purported white-hat hackers" rather than being identified as authentic security experts. The distinction is crucial because the money was taken out of the Federation wallet without permission, and it is still unknown what their ultimate plans are.

According to the Liquid Network team, the Blockstream team was attempting to get in touch with the relevant parties via an on-chain signed message. This implies that establishing a direct line of communication with the person in charge of the withdrawn Bitcoin is the present emphasis of the response.

We are aware of a security incident on @Liquid_BTC. Purported white-hat hackers have withdrawn ~4,000 BTC (~$320 million) from the Liquid Federation wallet. The @Blockstream team is working on contacting them on-chain with a signed message.

What we know so far is that the funds…

— Liquid Network 🌊 (@Liquid_BTC) September 6, 2026

Stolen Bitcoin Consolidated Into One Address

PeckShield gave more information about how the money was transferred. The nearly 4,000 BTC was taken from the Liquid Federation wallet and then combined into a single Bitcoin address, according to the blockchain security company.

PeckShield has identified bc1ql4mfu6aundtkksxklfajs2h3t9nzcd6gyqjlte as the address. As the event progresses, the funds have a clear on-chain destination due to the consolidation.

The attacker or attackers also left a note related to the on-chain activity instead of just shifting the Bitcoin without providing an explanation. "We are whitehats. Contact us on-chain," the note said.

#PeckShieldAlert ~4,000 BTC (~$320M) siphoned from the Liquid Federation wallet

The attacker(s) consolidated the funds into bc1ql4mfu6aundtkksxklfajs2h3t9nzcd6gyqjlte, leaving an on-chain message: "we are whitehats. contact us on chain." pic.twitter.com/wYAVN3IRg5

— PeckShieldAlert (@PeckShieldAlert) September 7, 2026

Attackers Claim to Be Whitehats

An additional dimension to the situation is the assertion that the attackers are white-hats. They were referred to as "purported white-hat hackers" by Liquid Network itself, implying that the assertion has not been independently verified.

The on-chain communication seems to be an attempt to speak with Blockstream or Liquid straight following the withdrawal. According to Blockstream, it is attempting to get in touch with the parties via a signed on-chain message, establishing a direct channel of communication that might assist explain why the Bitcoin was stolen and what the attackers plan to do with it.

Whether the people will repay the money or offer further details on the security incident is still the crucial question at this point.

Blockstream Attempts On-Chain Contact

Now, Blockstream is working to get in touch with the owners of the Bitcoin that was withdrawn. According to Liquid Network, its team is utilising Blockstream to send a signed message on the Bitcoin blockchain to the alleged white-hat hackers.

In the meantime, a public trail for monitoring the roughly 4,000 BTC is provided by the combined address that PeckShield identified. As Liquid looks into what happened to the Federation wallet, the issue has a visible trail because of the on-chain message, the specified destination address, and Blockstream's outreach.

For now, the central questions are whether the withdrawals were carried out as a white-hat intervention, whether the funds will be returned, and what further information the parties controlling the Bitcoin provide through the on-chain communication channel.

If you find any issues in this article or notice missing information, please feel free to reach out at team@etherworld.co for clarifications or updates.

To promote your Web3 articles, events, and projects, you may reach out anytime via EtherWorld PR for submissions and collaboration.

Related Articles

1. AMC CEO Blasts Robinhood Over Unregistered Stock Tokens
2. National Sheriffs’ Association Shifts to Neutral on CLARITY Act
3. Standard Chartered Launches BTC & ETH Trading to UAE
4. Remixpoint Dumps Altcoins for Bitcoin-Only Treasury Strategy
5. Two SEC Moves Point Toward Always-On, On-Chain Markets

To follow blockchain news, track Ethereum protocol progress, and read our latest stories, subscribe to our weekly today.

Join the EtherWorld & Avarch Internship Program and build your career in blockchain, content, social media, video, podcast editing, or operations. Send your resume and brief introduction to contact@etherworld.co.