Community Trust ScoreVerified
Nearly 4,000 Bitcoin — worth around $319 million — got pulled out of the Liquid Network sidechain over the weekend. Blockstream, which runs the network, paused its bridge nodes fast and told exchanges to stop LBTC deposits and withdrawals while the investigation runs.
The twist: whoever did it might not be a thief. An unverified OP_RETURN message left on-chain claimed the people behind the extraction were white hat hackers. They invited Blockstream to contact them “on chain.” No names. No further details. Unclear yet whether anyone’s made that contact.
How the Extraction Happened
The numbers are pretty striking. Liquid Network’s federation wallet balance fell from roughly 4,200 BTC down to just over 207 BTC. That’s basically the whole thing, gone in one move.
Under normal conditions, Bitcoin on the sidechain gets burned before any withdrawal can happen, and the process needs an 11-of-15 multisig approval to go through. The extraction bypassed all of that. Liquid Network said the funds came out through the SideSwap Peg-out Authorization Key — known as the PAK — but clarified that the key itself wasn’t compromised. So the mechanics worked, kind of, just not in the way they were supposed to.
Analysts watching the situation think the coins are probably still unspent on the Bitcoin main chain. That lines up with a white hat scenario more than an outright theft. But nothing’s confirmed. Blockstream and other stakeholders are working to reach the purported white hats and figure out what actually happened.
The breach raises hard questions about the multisignature and whitelist systems the Liquid Network relies on. Those mechanisms exist specifically to block unauthorized withdrawals. The fact that someone got around them — using a key that wasn’t even technically compromised — is going to force a serious look at where the gaps are. No timeline on that review has been shared publicly.
Bitcoin ETFs Keep Pulling In Cash
Separate from the Liquid Network drama, US Bitcoin ETFs had a strong run. Over three weeks, these funds pulled in $3.8 billion total. The week ending Friday alone brought in $986.9 million. Assets under management across the ETF category hit $101.3 billion.
Bitcoin was trading near $80,000 during the period. It hasn’t cleared the 50-week moving average yet — that’s still a key level traders are watching. But the inflows suggest investor appetite isn’t fading. Bitcoin closed the week up 2.6% at $80,234. Ethereum traded at $2,513 and XRP at $1.42, both posting gains on the week.
Not all altcoins had a good week. PONS jumped 140% and broke into the top 100 coins. Arbitrum gained 116%. Dash was up 66%. On the other side, Pump.fun dropped 13.2%, Canton fell 6.9%, and Official Trump slid 4.1%.
Stablecoins, El Salvador, and a Malware Warning
A consortium of 21 major financial institutions — Bank of America and Goldman Sachs among them — said they want to build a US dollar-denominated stablecoin. They’re aiming for a launch in 2027, pending the group’s formation and the necessary regulatory approvals. Plans reportedly go beyond the dollar, with the euro next in line among G7 currencies. It’s a big move if it happens. Traditional finance has been circling stablecoins for years, and a consortium this size actually committing to a launch date is different from the usual exploratory talk.
The G20 also weighed in this week, issuing a statement backing crypto’s role in economic growth while calling for regulatory and supervisory measures. No specifics on enforcement mechanisms.
El Salvador’s Bitcoin strategy came up again. Reports suggested the country’s recent Bitcoin accumulation didn’t involve public funds — the IMF noted that private donations drove the increase in holdings, not government purchases. President Nayib Bukele pushed back, saying no public resources were used. The back-and-forth between Bukele and international institutions has been going on for a while now, and it’s not really resolved here either.
And in cybersecurity, a fake desktop app called Claude has been flagged as a distribution vector for RevStealer malware. The app impersonates Anthropic, the AI developer. Once installed, it targets crypto wallets and goes after passwords and browser data. It’s a reminder that threats to digital asset holders don’t always come through exchanges or protocols — sometimes it’s just a convincing fake download.
Robinhood’s PONS launchpad on Ethereum’s Layer 2 also drew attention. The platform pairs meme coins with tokenized stock offerings, including AMC. AMC’s CEO publicly said the company didn’t give permission for its stock to be tokenized that way. No resolution there yet.
The Liquid Network situation is still open. Funds appear unspent. Hackers haven’t been publicly identified. And Blockstream hasn’t said when — or whether — it expects to recover the 4,000 BTC.
Frequently Asked Questions
How much Bitcoin was extracted from the Liquid Network?
Nearly 4,000 Bitcoin, valued at approximately $319 million, were extracted from the Liquid Network sidechain, dropping the federation wallet balance from around 4,200 BTC to just over 207 BTC.
How did the extraction bypass Liquid Network’s security?
The funds were withdrawn through the SideSwap Peg-out Authorization Key (PAK), bypassing the normal 11-of-15 multisig approval requirement, though Liquid Network said the PAK itself was not compromised.
What were US Bitcoin ETF inflows during this period?
US Bitcoin ETFs attracted $3.8 billion over three weeks, with $986.9 million coming in the final week alone, pushing total assets under management to $101.3 billion.
Why It Matters
The withdrawal of 4,000 Bitcoin from the Liquid Network highlights ongoing vulnerabilities in blockchain infrastructure, raising concerns about security protocols amid increasing market activity, particularly with Bitcoin ETFs reaching significant investment levels. The involvement of purported white hat hackers introduces a complex dynamic, as it suggests a potential for safeguarding measures rather than malicious intent, which could impact investor confidence and regulatory scrutiny in the crypto space. This incident underscores the critical balance between innovation and security as the ecosystem evolves.
