Roughly $319 million in Bitcoin was withdrawn from Blockstream's Liquid network on Sunday in a transaction costing 21 cents in fees. Following the withdrawal, an on-chain message was left stating that the actors were white-hat hackers.
The initial move occurred at 14:06 UTC, transferring 3,996 coins—representing 95% of the network's holdings—to a previously unused address. Four hours later, another transaction occurred with a fee of 269 satoshis, approximately 21 cents, carrying the message "we are whitehats. contact us on chain." A small amount of 0.00001 BTC was sent back to a Liquid address, while the remaining 3,998.49 coins have not moved since.
The Liquid Network operates under a rule requiring matching tokens inside the network to be destroyed before coins are withdrawn. As a result, when the reserves decreased, the corresponding tokens shrank as well. The network's remaining coins remain fully covered, with the peg holding and no shortfall for holders of L-BTC.
Prior to the incident, the network held approximately 4,193 coins. According to Blockstream's documentation, 15 companies form the federation, and 11 signatures are required for coins to leave. The destinations are intended to use whitelisted addresses as a failsafe to maintain federation control. The funds currently sit in the new address, and the Blockstream team is working on contacting the actors on-chain with a signed message.
