Attackers Leave On-chain Message After $320 Million Exits Liquid Network

Someone pulled $319 million in Bitcoin (BTC) out of Blockstreams Liquid network on Sunday. It cost 21 cents in fees. Then they left a note on the blockchain saying they were the good guys. While the internet calls it a heist, the chain says something stranger. Liquids remaining coins are still fully covered, down to the fourth decimal place. What we know so far is that the funds $320M Crypto Reserve Moves, But the Wallet Left a Strange Message The first move cleared at 14:06 UTC, releasing 3,996 coins to an address nobody had ever used before. That was 95% of everything the network held. Four hours later the money moved again. The sender paid 269 satoshis, about 21 cents, and attached a message anyone can read. Actors left a message we are whitehats. contact us on chain. Source: memepool Then they sent 0.00001 back to Liquids own address. The other 3,998.49 coins have not moved since. It looks like ~4,000 BTC just moved from the Liquid Network bridge all at once with an OP Return saying, we are whitehats. contact us on chain, one user noted. The Part Everyone Missed Liquid runs on one rule: To take coins out, you destroy the matching tokens inside the network first. So when the reserve shrank, the tokens it backs shrank with it. Both landed in nearly the same spot. The peg holds, with 0.22 coins to spare. Nobody still holding L-BTC is short a satoshi. That kills the insolvency story. However, it leaves a worse one. Add what left to what remains, and the network held about 4,193 coins on Saturday. Nearly all of them were burned to make this move work. Blockstream is clear about who can do that. Only a federation member can burn the tokens. Fifteen companies hold the keys, and 11 must sign before coins leave. Its documentation calls the destination list a safeguard. Whitelisted addresses are used as a failsafe to ensure that the federation always remains in full control of the BTC held by the Liquid Network, the team said in its documentation. The coins went to a brand new address. Blockstream has not explained that, or said anything at all. Traders have seen this before, particularly with Ronin bridge attackers who gave back $10 million and took a bounty in 2024. The money sits still, in daylight. Whoever holds it asked to be contacted. Nobody has answered. Read the article at BeInCrypto