Liquid attackers offer to return most of 4,000 BTC

cryptonews09-07 15:43

On Sept. 7, unidentified actors controlling nearly 4,000 BTC taken from Liquid Network offered to return “most” of the funds after Blockstream fixes the vulnerability behind the estimated $320 million...

Source Link

Disclaimer: Investing carries risk. This is not financial advice. The above content should not be regarded as an offer, recommendation, or solicitation on acquiring or disposing of any financial products, any associated discussions, comments, or posts by author or other users should not be considered as such either. It is solely for general information purpose only, which does not consider your own investment objectives, financial situations or needs. TTM assumes no responsibility or warranty for the accuracy and completeness of the information, investors should do their own research and may seek professional advice before investing.

Comments

We need your insight to fill this gap

Leave a comment

{"i18n":{"language":"en_US"},"isChannel":false,"data":{"share":"https://ttm.financial/m/news/2665977783?lang=en_US&edition=fundamental","thumbnail":"","is_english":true,"pubTime":"2026-09-07 15:43","share_image_url":"https://static.laohu8.com/e9f99090a1c2ed51c021029395664489","id":"2665977783","market":"us","top_or_hot":-1,"title":"Liquid attackers offer to return most of 4,000 BTC","media":"cryptonews","content":"<div>\n<p>On Sept. 7, unidentified actors controlling nearly 4,000 BTC taken from Liquid Network offered to return “most” of the funds after Blockstream fixes the vulnerability behind the estimated $320 million...</p>\n\n<a href=\"https://crypto.news/liquid-attackers-offer-to-return-most-of-4000-btc/\">Source Link</a>\n\n</div>\n","source":"crypto_news_highlight","html":"<!DOCTYPE html>\n<html>\n<head>\n<meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\" />\n<meta name=\"viewport\" content=\"width=device-width,initial-scale=1.0,minimum-scale=1.0,maximum-scale=1.0,user-scalable=no\"/>\n<meta name=\"format-detection\" content=\"telephone=no,email=no,address=no\" />\n<title>Liquid attackers offer to return most of 4,000 BTC</title>\n<style type=\"text/css\">\na,abbr,acronym,address,applet,article,aside,audio,b,big,blockquote,body,canvas,caption,center,cite,code,dd,del,details,dfn,div,dl,dt,\nem,embed,fieldset,figcaption,figure,footer,form,h1,h2,h3,h4,h5,h6,header,hgroup,html,i,iframe,img,ins,kbd,label,legend,li,mark,menu,nav,\nobject,ol,output,p,pre,q,ruby,s,samp,section,small,span,strike,strong,sub,summary,sup,table,tbody,td,tfoot,th,thead,time,tr,tt,u,ul,var,video{ font:inherit;margin:0;padding:0;vertical-align:baseline;border:0 }\nbody{ font-size:16px; line-height:1.5; color:#999; background:transparent; }\n.wrapper{ overflow:hidden;word-break:break-all;padding:10px; }\nh1,h2{ font-weight:normal; line-height:1.35; margin-bottom:.6em; }\nh3,h4,h5,h6{ line-height:1.35; margin-bottom:1em; }\nh1{ font-size:24px; }\nh2{ font-size:20px; }\nh3{ font-size:18px; }\nh4{ font-size:16px; }\nh5{ font-size:14px; }\nh6{ font-size:12px; }\np,ul,ol,blockquote,dl,table{ margin:1.2em 0; }\nul,ol{ margin-left:2em; }\nul{ list-style:disc; }\nol{ list-style:decimal; }\nli,li p{ margin:10px 0;}\nimg{ max-width:100%;display:block;margin:0 auto 1em; }\nblockquote{ color:#B5B2B1; border-left:3px solid #aaa; padding:1em; }\nstrong,b{font-weight:bold;}\nem,i{font-style:italic;}\ntable{ width:100%;border-collapse:collapse;border-spacing:1px;margin:1em 0;font-size:.9em; }\nth,td{ padding:5px;text-align:left;border:1px solid #aaa; }\nth{ font-weight:bold;background:#5d5d5d; }\n.symbol-link{font-weight:bold;}\n/* header{ border-bottom:1px solid #494756; } */\n.title{ margin:0 0 8px;line-height:1.3;color:#ddd; }\n.meta {color:#5e5c6d;font-size:13px;margin:0 0 .5em; }\na{text-decoration:none; color:#2a4b87;}\n.meta .head { display: inline-block; overflow: hidden}\n.head .h-thumb { width: 30px; height: 30px; margin: 0; padding: 0; border-radius: 50%; float: left;}\n.head .h-content { margin: 0; padding: 0 0 0 9px; float: left;}\n.head .h-name {font-size: 13px; color: #eee; margin: 0;}\n.head .h-time {font-size: 11px; color: #7E829C; margin: 0;line-height: 11px;}\n.small {font-size: 12.5px; display: inline-block; transform: scale(0.9); -webkit-transform: scale(0.9); transform-origin: left; -webkit-transform-origin: left;}\n.smaller {font-size: 12.5px; display: inline-block; transform: scale(0.8); -webkit-transform: scale(0.8); transform-origin: left; -webkit-transform-origin: left;}\n.bt-text {font-size: 12px;margin: 1.5em 0 0 0}\n.bt-text p {margin: 0}\n</style>\n</head>\n<body>\n<div class=\"wrapper\">\n<header>\n<h2 class=\"title\">\nLiquid attackers offer to return most of 4,000 BTC\n</h2>\n\n<h4 class=\"meta\">\n\n\n2026-09-07 15:43 GMT+8&nbsp;&nbsp;&nbsp;<a href=https://crypto.news/liquid-attackers-offer-to-return-most-of-4000-btc/><strong>cryptonews</strong></a>\n\n\n</h4>\n\n</header>\n<article>\n<div>\n<p>On Sept. 7, unidentified actors controlling nearly 4,000 BTC taken from Liquid Network offered to return “most” of the funds after Blockstream fixes the vulnerability behind the estimated $320 million...</p>\n\n<a href=\"https://crypto.news/liquid-attackers-offer-to-return-most-of-4000-btc/\">Source Link</a>\n\n</div>\n\n\n</article>\n</div>\n</body>\n</html>\n","isBrief":false,"type":0,"news_type":1,"symbol":"BCCC","symbol_name":"Global X Bitcoin Covered Call ETF","start_time":0,"source_url":"https://crypto.news/liquid-attackers-offer-to-return-most-of-4000-btc/","article_id":"2665977783","we_media_id":null,"thumbnails":[],"rights":{"source":"crypto_news_highlight","url":"https://crypto.news/liquid-attackers-offer-to-return-most-of-4000-btc/","rn_cache_url":null,"directOrigin":true},"url":"https://stock-news.laohu8.com/highlight/detail?id=2665977783","pubTimestamp":1788767027,"columns":[],"sourceInfo":{"source_id":"crypto_news_highlight","name":"Crypto News"},"weMediaInfo":null,"summary":"On Sept. 7, unidentified actors controlling nearly 4,000 BTC taken from Liquid Network offered to return “most” of the funds after Blockstream fixes the vulnerability behind the estimated $320 million incident.The unidentified actors offered to return most funds after Blockstream patches the undisclosed network vulnerability.The actors communicated their offer through Bitcoin transactions carrying OP_RETURN messages, according to a reconstruction published by Galaxy Research head Alex Thorn. They asked whether returning “most” of the Bitcoin to the federation’s address would be acceptable.That promise remains unverified. The actors did not define how much “most” represents, disclose their identities or provide a deadline. No confirmed return transaction had appeared when this article was prepared.At block 965,869, the actors sent 1,000 satoshis to the federation’s peg address and asked about returning most of the funds. They provided their patch demand six blocks later. The messages es","collect":0,"end_time":0,"defaultTopTitle":"crypto.news","property":[],"viewcount":null,"language":"en","relate_stocks":{"83042":"华夏比特币-R","BCCC":"Global X Bitcoin Covered Call ETF","BTRN":"比特币期货ETF-Global X","03439":"嘉实比特币","YBIT":"YieldMax Bitcoin Option Income ETF","BITB":"比特币ETF-Bitwise","03042":"华夏比特币","STCE":"Schwab Crypto Thematic ETF","XBTY":"GraniteShares YieldBOOST Bitcoin ETF","BTCZ":"T-Rex 2X Inverse Bitcoin Daily Target ETF","BTYB":"VistaShares BitBonds 5 Yr Enhanced Weekly Distribution ETF","QBF":"Innovator Uncapped Bitcoin 20 Floor ETF - Quarterly","MSBT":"Morgan Stanley Bitcoin Trust ETP","09042":"华夏比特币-U","BETE":"等权重比特币&以太币期货ETF-ProShares","03008":"博时比特币","OOQB":"One+One Bitcoin and Ether ETF","09439":"嘉实比特币-U","BETH":"比特币&以太币期货ETF-ProShares","BTC":"Grayscale Bitcoin Mini Trust","MAXI":"比特币期货ETF-Simplify","YBTC":"比特币看涨期权ETF-Roundhill","BITO":"比特币期货ETF-ProShares","NCIQ":"HASHDEX NASDAQ CRYPTO INDEX US ETF","BRRR":"比特币ETF-CoinShares","GBTC":"比特币ETF-Grayscale","BEGS":"RAREVIEW 2X BULL CRYPTOCURRENCY & PRECIOUS METALS ETF","BTCI":"NEOS Bitcoin High Income ETF","BTF":"比特币&以太币期货ETF-CoinShares","CBOA":"Calamos Bitcoin Structured Alt Protection ETF - April","BTFX":"比特币期货ETF-CoinShares","09008":"博时比特币-U","CBOJ":"Calamos Bitcoin Structured Alt Protection ETF - January","CRPT":"First Trust SkyBridge Crypto Industry and Digital Economy ETF","CBTA":"Calamos Bitcoin 80 Series Structured Alt Protection ETF – April","DEFI":"比特币期货ETF-Hashdex","ARKY":"ARK Active Autocallable Income ETF","BFAP":"FT Vest Bitcoin Strategy Floor15 ETF - April","BTGD":"STKD Bitcoin & Gold ETF","BTCL":"T-REX 2X LONG BITCOIN DAILY TARGET ETF","MNRS":"GRAYSCALE BITCOIN MINERS ETF","CBTJ":"Calamos Bitcoin 80 Series Structured Alt Protection ETF - January","IBIT":"比特币ETF-iShares","BITY":"Amplify Bitcoin 2% Monthly Option Income ETF","BITX":"2倍比特币期货ETF-Volatility Shares","CBOO":"Calamos Bitcoin Structured Alt Protection ETF - October"},"translate_title":"液体攻击者提出归还 4,000 BTC 中的大部分","themeId":null,"isJumpTheme":false,"ttsUrl":null,"symbols_score_info":{"83042":0.6,"BETH":1.5,"BRRR":1.5,"BTCZ":1.5,"YBIT":1.5,"MAXI":1.5,"09008":0.9,"BTF":1.5,"YBTC":1.5,"DEFI":0.6,"03042":0.9,"NCIQ":1.5,"GBTC":0.6,"CBTA":0.6,"BCCC":0.6,"MSBT":1.5,"OOQB":1.5,"03439":0.9,"BEGS":1.5,"CBOO":0.6,"BITO":0.6,"BTYB":0.9,"BTFX":1.5,"ARKY":1.5,"03008":0.9,"09439":0.9,"CBOJ":0.6,"BITX":1.5,"BTCmain":1.5,"09042":0.9,"BTGD":1.5,"QBF":0.6,"IBIT":1.5,"BITB":0.6,"XBTmain":1.5,"BFAP":0.6,"BTCL":1.5,"CBOA":0.6,"BITY":0.6,"CBTJ":1.5,"CRPT":1.5,"MNRS":1.5,"BETE":1.5,"STCE":1.5,"XBTY":0.6,"BTC":0.9,"BTRN":1.5,"BTCI":1.5},"content_text":"On Sept. 7, unidentified actors controlling nearly 4,000 BTC taken from Liquid Network offered to return “most” of the funds after Blockstream fixes the vulnerability behind the estimated $320 million incident.\n\n\nSummary\n\n\n\nNearly 4,000 BTC left Liquid’s federation wallet, representing approximately 95% of its reported Bitcoin reserves.\nThe unidentified actors offered to return most funds after Blockstream patches the undisclosed network vulnerability.\nBitcoin OP_RETURN messages and PGP signatures created a publicly verifiable communication channel between both parties.\nLiquid disabled bridge nodes and asked exchanges to suspend L-BTC deposits and withdrawals during investigation.\nNo confirmed repayment, public patch or network reopening had occurred when this article was prepared.\n\n\n\nThe actors communicated their offer through Bitcoin transactions carrying OP_RETURN messages, according to a reconstruction published by Galaxy Research head Alex Thorn. They asked whether returning “most” of the Bitcoin to the federation’s address would be acceptable.\nA later message told Blockstream to “fix the bug first” and ensure every node received the patch. The actors claimed the chain remained exposed under its latest software version and promised to transfer the money after confirming the repair.\n\n💧 LIQUID WHITE HATS SAY THEY’LL RETURN ‘MOST’ OF 4000 BTC ONCE LIQUID NETWORK BUG IS PATCHEDthe hackers have been conversing with blockstream via OP_RETURN messages and PGP encrypted text– block 965,822 blockstream address sent 1,000 sat with \"Please contact security at… pic.twitter.com/VP8IkOvftl— Alex Thorn (@intangiblecoins) September 7, 2026\n\nThat promise remains unverified. The actors did not define how much “most” represents, disclose their identities or provide a deadline. No confirmed return transaction had appeared when this article was prepared.\nOn-chain messages authenticate the negotiation\nBlockstream initiated contact at Bitcoin block 965,822 by sending 1,000 satoshis with a message directing the recipient to its security team. Another transaction contained encrypted material and a detached signature verifiable against Blockstream’s published PGP key.\nAt block 965,869, the actors sent 1,000 satoshis to the federation’s peg address and asked about returning most of the funds. They provided their patch demand six blocks later. The messages establish that someone controlling the relevant Bitcoin could respond to Blockstream. They do not independently prove the actors’ motives.\nThe incident began with a peg-out of approximately 3,996 BTC. The corresponding Bitcoin transaction was confirmed in block 965,783 on Sept. 6. A separate transaction carried the initial claim: “we are whitehats. contact us on chain.”\nThe 4,000 BTC withdrawal exposed Liquid’s peg\nLiquid confirmed that approximately 4,000 BTC had left its federation wallet. It described those responsible as “purported white-hat hackers,” preserving uncertainty around their status.\nThe network said the withdrawal used SideSwap’s Peg-out Authorization Key, or PAK. However, it said there was no evidence that the key itself was compromised. Liquid has not publicly explained the underlying vulnerability or released a technical postmortem.\nLiquid operates as a Bitcoin sidechain whose users lock BTC and receive L-BTC for activity on the network. The federation holds the underlying Bitcoin and authorizes withdrawals back to the base layer. The transfer reportedly removed about 95% of the wallet’s Bitcoin.\nLiquid disabled its bridge nodes and asked exchanges to suspend L-BTC deposits and withdrawals. It said other issued assets, including stablecoins and real-world assets, were not directly removed. The sidechain remained effectively paused while the investigation continued.\nThe episode adds another large loss to a year dominated by infrastructure failures. As crypto.news reported, crypto protocols lost at least $1.3 billion to hacks during the first eight months of 2026. In related coverage, an examination of cross-chain bridge security explained how concentrated custody and authorization systems can create large points of failure.\nBlockstream must patch the network before any restart\nBlockstream’s immediate task is to identify the flaw, prepare a patch and distribute it across the federation. The actors specifically demanded that every node be updated before repayment. Blockstream has not announced a patch version or reopening time.\nA return can only be treated as confirmed after the Bitcoin moves to an address controlled by the federation. Even then, the amount retained by the actors and any proposed bounty would require disclosure.\nLiquid must also account for the remaining reserves, explain how the peg-out bypassed normal controls and specify how L-BTC redemptions will resume. A technical postmortem would be needed to show whether the problem involved software, authorization logic, federation operations or another part of the withdrawal process.\nUntil those steps occur, the repayment remains a conditional promise and the “white hat” description remains disputed.\n\n\n\n\n\n                Read more:\n            \n\n                Capital B acquires €25.3m in Bitcoin after completing capital raises","kind":"highlight","is_publish_news":true,"is_publish_highlight":false,"is_publish_live":false,"is_publish_wemedia":false,"editions":null,"column":"","sentiment":"0","news_tag":"","news_rank":0,"isVideo":false,"video":null,"symbols":[],"gpt_button":0,"need_auth":false,"need_login_tip":false,"code":"91000000","status":"200"},"commentList":[],"isCommentEnd":true,"newsSizeData":{"likeSize":0,"commentSize":0,"repostSize":0,"favoriteSize":0,"likeStatus":false,"favoriteStatus":false},"APP":{"userAgent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","isDev":false,"isTTM":true,"isLaohu8Offline":false,"tenantId":"TBGLOBAL","deviceId":"web-server-community-laohu8-v3","version":"4.49.0","shortVersion":"4.49.0","platform":"web","vendor":"web","appName":"ttm","isIOS":false,"isAndroid":false,"isTiger":false,"isTHS":false,"isWeiXin":false,"isWeiXinMini":false,"isWeiBo":false,"isQQ":false,"isBaiduSwan":false,"isBaiduBox":false,"isDingTalk":false,"isToutiao":false,"isOnePlus":false,"isHuaWei":false,"isXiaomi":false,"isXiaomiWebView":false,"isOppo":false,"isVivo":false,"isSamsung":false,"isMobile":false},"href":"/m/news/2665977783","isCrawlerRequest":true}