Aggregator
Hackers Withdraw 320 Million In Bitcoin From Blockstream's Liquid Network Federation Reserves
Authored by Juan Galt via BitcoinMagazine.com,
The Liquid Network said Sunday that purported white-hat hackers withdrew about 4,000 bitcoin, worth about $320 million, from the federation wallet that backs L-BTC.
Bridge nodes were disabled, and the sidechain was paused. Other issued assets, including USDT, DePix and RWAs, were unaffected, the official account said on X.
The Liquid Network is a federated sidechain of Bitcoin, founded by Adam Back’s Blockstream. The Liquid chain issues a variety of assets such as LBTC, which it backs with BTC on the Bitcoin main chain, held in a large multisig of 15 corporate and known members. 11 of the 15 members need to sign a valid multi-signature transaction to move coins from the treasury. Before the hack, the treasury held over 4200 BTC; after the hack, Blockstream’s proof of reserves page reports a little over 207 BTC left.
The hackers withdrew 4,019.4 BTC from the reserve address in a peg-out transaction using the SideSwap Peg-out Authorization Key. SideWap is a bridge exchange and a member of the Liquid Federation. While details on the mechanism of the hack are not confirmed yet, it appears an inflation bug on the LBTC side chain was exploited by the hackers to create over 4,000 LBTC that did not exist before, and cash them out for on-chain bitcoin from the federation. Because the transaction appeared as valid, given the consensus bug, the federation members’ HSM security servers signed the BTC withdrawal transaction, worth roughly 320 million at the time.
The hacker moved the funds to an address ending in 6gyqjlte, from which they quickly signed a new transaction with a message on the OP_RETURN arbitrary data field saying “we are whitehats. contact us on chain.” Those coins were still at that address at the time of writing.
A small mainnet transaction to the hacker address followed by an OP_RETURN saying “Please contact security@blockstream.com”, presumably from a Blockstream public address, though that remains unconfirmed. A later OP_RETURN spend from the hacker address carried “Please contact us on Signal @m671aw.70”, however, this may be spam and does not share a link to the address with the stolen funds.
In response to the breach, exchanges were told to pause L-BTC deposits and withdrawals. Bridge nodes on the Liquid Network have been paused, limiting access to the side chain, which continues to produce blocks.
JAN3 CEO Samson Mow said Aqua’s Liquid features were affected and that on-chain bitcoin still worked. Other wallets in the industry that use the Liquid Network are expected to be affected. Users holding LBTC now effectively have their savings at risk, since the underlying BTC is currently not redeemable. Given the private nature of the Liquid chain, user onchain analytics are scarce and not much public information is known about how much LBTC is held by retail users versus corporations of Blockstream itself. Nevertheless, should the funds not be returned, it would be a heavy blow to the Liquid Network’s user base.
Users of LBTC don’t have many options but to wait for conversations with the hackers to resolve. Given the size of the hack, it would be difficult for the hackers to get away with stealing all that bitcoin, though perhaps not impossible.
What may happen is that the hackers ask for a finder’s fee and return the majority of the funds.
Tyler Durden Mon, 09/07/2026 - 16:00Billionaire Lululemon founder Chip Wilson’s no-prenup divorce could cost him painful 50-50 split
‘Howard Stern Show’ segment quietly canceled after staff layoffs
‘Howard Stern Show’ segment quietly canceled after staff layoffs
Free apartment in California beauty spot up for grabs as historic tourist destination seeks volunteers
Premier rehearsal facility Open Jar Studios expands in Times Square
Iron Ore Bottom In? Prices Reclaim $100 On "Improving Downstream Conditions"
Iron ore futures in Singapore surged above $100 a ton, the highest level since mid-July, as tightening Chinese coking coal supplies lifted steelmaking costs and early signs of improving seasonal demand supported prices across the steel supply chain.
Rafael Barcellos, head of Latin American metals and mining, pulp and paper equity research at Bradesco BBI, wrote in a note last week that the coal squeeze is helping support steel prices, with rebar and hot-rolled coil reaching multi-month highs. Improving downstream conditions are, in turn, providing support for iron ore.
Barcellos pointed to China's August manufacturing purchasing managers' index as another encouraging economic signal.
Iron ore inventories also continued to decline, spot activity at Chinese steel-trading houses increased for a second consecutive week, and steelmaker margins improved. Blast furnace utilization, however, declined for a second week, tempering the recovery picture.
Barcellos flagged a recovery:
Even so, the recovery we flagged in VALE: Calling the Iron Ore Bottom? Attractive Asymmetry After 2Q26 Results is now playing out, with prices largely rebounding from the lows of the past couple of weeks — a trend we expect to persist amid firm cost support and improving downstream conditions.
Barcellos' trade recommendation:
Against this backdrop, we continue to favor Vale and Ternium over CSN, Gerdau, and Usiminas.
China's prolonged property downturn has weakened a major source of steel demand, weighing on iron ore prices despite periodic rebounds.
The latest recovery to $100 a ton raises the question of whether improving seasonal conditions can translate into a sustained demand growth story, keeping prices in triple-digit territory.
In the metals complex on Monday, London copper futures reached a new high of $14,530 a ton. For further context, we direct readers to our note, "The Copper Chart Causing Alarm."
Professional subscribers can read much more about the latest metals space here on our new Marketdesk.ai portal.
Tyler Durden Mon, 09/07/2026 - 15:30