Ledger's Chief Technology Officer has questioned the white hat label attached to approximately $320 million taken from Liquid Network, a Bitcoin layer-2 sidechain that uses a two-way peg to connect Bitcoin with its native Liquid Bitcoin asset.
Around 4,000 Bitcoin left the Liquid Federation wallet on September 6, 2026. The transfer used the SideSwap Peg-Out Authorization Key, which Liquid stated was not compromised. SideSwap confirmed that a customer sent 4,000 LBTC to its peg-out service, and the federation paid out 3,996 BTC approximately 23 minutes later. Blockstream traced the LBTC to a bug in Elements software.
The funds were consolidated into a single Bitcoin address containing an on-chain message stating "we are whitehats. contact us on chain." Galaxy Research estimated the transferred amount represented approximately 95% of all Bitcoin pegged to Liquid at the time.
Skepticism Over White Hat Claims
Charles Guillemet, chief technology officer at Ledger, expressed doubt about the white hat characterization. He compared the incident to the Ronin hack, where attackers stole approximately $625 million after compromising validator keys, noting that legitimate white hats do not typically drain bridges and then solicit on-chain contact.
Guillemet later softened his assessment, suggesting the conduct may not follow usual white hat practice, though criminal groups also do not typically attempt to contact victims. He noted the possibility that the actors could be individuals unfamiliar with responsible disclosure processes.
Network Response and Current Status
Liquid disabled bridge nodes following the incident, preventing new transactions from entering the chain. Exchanges were notified and paused or prepared to pause L-BTC deposits and withdrawals. Other Liquid assets, including USDT, DePix, and real-world assets, remained unaffected.
As of the article's publication, the funds remained in the receiving address, which held approximately 3,998 BTC. The federation wallet retained roughly 197 BTC. Early Monday, the address signed a message asking whether returning most funds to the federation wallet would be acceptable.
