Blockstream pauses Liquid after $320 million exploit, tries to reach hackers onchain

Twenty-three minutes separated the order from the payout. SideSwap logged 4,000 L-BTC arriving at its peg-out service at 14:05 UTC, and the Liquid Federation paid 3,996 BTC to the customer's bitcoin address at 14:28 ^[3][1]. Mainchain funds require an 11-of-15 federation multisignature, and the Peg-out Authorization Key system is meant to confine payments to approved wallets ^[8]. By Blockstream's own account, neither of those broke: the SideSwap PAK used was not compromised, and nor was any other key ^[7]. What failed sat upstream of everything that held, because the L-BTC presented for burning had been created by a bug in the Elements software ^[4]. A quorum can only check the transaction in front of it, and this one was correctly authorised.

Onchain researcher Ergo BTC flagged the two linked transactions, including a follow-up that spent about 3,998.5 BTC and carried a message reading "we are whitehats. contact us on chain" ^[11][10]. As of roughly 3 p.m. EDT, neither Blockstream, Liquid nor Adam Back had addressed it publicly; the Liquid Network account confirmed the incident at 4:25 p.m. ^[20]. For more than an hour, the people deciding whether to halt L-BTC exposure were working from a sleuth's thread and a swap marketplace's post rather than the operator's.

The operator's containment worked as designed, but recovery depends on a different instrument entirely. Bridge nodes were disabled so no new transactions can be submitted, exchanges were notified to pause L-BTC deposits and withdrawals, and unrelated Liquid assets including USDT and DePix were left running ^[15][6][16]. Blockstream's channel to the party holding the bitcoin is an OP_RETURN reading "Please contact [email protected]" ^[5], sent to an entity identified only by its own claim. Ledger CTO Charles Guillemet said the parties have asked to be reached on Signal, that this does not look like usual white hat practice, and that they might be well-intentioned people who played intensively with recent LLMs and are unused to responsible disclosure ^[12]. Bitcoin.com's own coverage warned that treating the message as proof of good intent gets ahead of the evidence, listing a compromised whitelisted wallet and abuse of Liquid's security mechanisms as unexcluded alternatives ^[18].

The coins are sitting in plain view on Bitcoin and had not obviously been mixed, which is how many white hat returns begin ^[17]. That is true, and visibility is not the same as recall. Blockstream's explorer showed 207.275 BTC where roughly 4,200 had backed the network for months, leaving about 5 percent of the reserve in place ^[9][2]. If nothing comes back, the $320 million is around a tenth of the $3.2 billion valuation attached to Blockstream ^[2][19][3]; a valuation is not cash, so that ratio sizes the hole against the firm without telling you a backstop exists.

What the record does not say is who owes the difference between 207.275 BTC and the L-BTC still outstanding. No statement from Blockstream, the federation or SideSwap in this material addresses it ^[7][3][9]. That silence is the part a treasury has to price, because it separates this week's problem from this decade's: this week the sidechain is paused and Aqua users have lost Liquid functionality while their bitcoin transactions keep working ^[14]; over a longer horizon, the question is whether a federated peg has a recovery step with an owner. On the evidence so far, its operator holds one lever, the pause, and the return is held by someone else.