Hackers Expropriate $320 Million from Bitcoin’s Liquid Network, Retain $47 Million in Contested ‘White‑Hat’ Move

Cybercriminals succeeded in diverting roughly $320 million worth of Bitcoin from the Liquid sidechain, a platform designed to speed settlement for traders and exchanges, and subsequently kept $47 million of the proceeds under their own control, describing the act as a white‑hat operation.

The Liquid Network, operated by a consortium of major cryptocurrency exchanges, offers faster transaction finality and confidential transfers compared with the main Bitcoin blockchain. Its high‑value liquidity and relative centralization make it an attractive target for attackers seeking large, swift payouts.

According to forensic analysis, the perpetrators exploited a vulnerability that allowed them to issue unauthorized withdrawals from multiple custodial wallets linked to the network. The stolen coins were shuffled through a series of mixing services and new addresses before the final tranche of $47 million was consolidated in wallets that the hackers claim they will later return.

The self‑characterization as a “white‑hat” hack has sparked debate within the crypto community. While the term traditionally implies a security researcher exposing a flaw without personal gain, the retention of a substantial sum blurs that line, leaving the question of the hackers’ “hat color” unresolved.

Users and institutions that relied on Liquid for large‑scale settlements are now assessing exposure and seeking reimbursements. Exchanges connected to the network have pledged to cooperate with law‑enforcement agencies, and regulators are watching closely as the incident underscores persistent security gaps in layered blockchain solutions.

Investigators are expected to trace the remaining funds through blockchain analytics, while the broader industry may accelerate efforts to harden sidechain protocols and adopt stricter custodial controls. The episode serves as a reminder that even advanced crypto infrastructures remain vulnerable to sophisticated attacks, prompting calls for more robust audit practices and clearer definitions of ethical hacking in the digital‑asset space.