Blockstream's Liquid Network experienced a significant exploit over the weekend of September 6, 2026, resulting in the drainage of nearly 4,000 BTC from the layer-two protocol's reserves. Self-described white hat hackers conducted the operation and have since returned 3,400 BTC, though 598.49 BTC remains in their possession.
Rather than traditional communication channels, both the hackers and Blockstream used the Bitcoin blockchain itself as a messaging platform throughout the incident. The white hats initiated contact by embedding "we are whitehats. contact us on chain" in an OP_RETURN transaction, a feature that allows users to attach public notes to Bitcoin payments.
Blockstream responded by directing the hackers to [email protected] and subsequently sent encrypted messages signed with a PGP key from that address. The white hats replied with their own onchain message asking for confirmation before returning the majority of the stolen funds. At 16:09 UTC, they transferred 3,400 BTC back to the federation wallet while retaining the remainder.
The onchain conversation attracted considerable secondary activity. Large numbers of Bitcoin users began sending dust transactions—small, nearly worthless amounts of BTC—to the white hat address, each embedding their own messages. This created significant noise within the communication channel.
The dust messages included multiple types of unsolicited content. Some promoted meme coins labeled "WHITE HAT" with links to Solana-based addresses and Pump.fun URLs. Others consisted of direct financial solicitations, with individuals requesting anywhere from 0.1 BTC to 10 BTC, citing unemployment, medical emergencies, or personal hardship. Several messages promoted cryptocurrency laundering methods through mixing services and the privacy coin Monero. Fraudulent schemes, including coin-doubling scams, also appeared among the messages.
As of the time of reporting, the Liquid Network remained frozen, and communications between Blockstream and the hackers continued. The rationale for retaining 598.49 BTC had not been publicly disclosed by the white hats, and the decision to keep a portion of the funds raised questions within the cryptocurrency community about the legitimacy of their white hat designation.
