A hacker stole $340M in a crypto heist, then returned most of it

A significant cryptocurrency theft hit Liquid Network this week when a hacker withdrew thousands of bitcoins from the settlement network’s wallet. Blockstream, the firm that launched Liquid in 2018, said on X that the attacker identified themselves as a "white hat" and that Liquid has halted operations while the issue is addressed. The seizure of roughly 4,000 BTC—valued at about $340 million—places the incident among the year’s largest recorded crypto heists.

Liquid Network is a settlement layer used by several cryptocurrency exchanges, and Blockstream moved quickly to suspend activity after the breach was detected. Initial reporting from crypto media outlets indicated the attacker exploited a bug to pull funds from the wallet and said they would return the assets if the vulnerability were fixed.

Former Blockstream executive Samson Mow posted on X that the company had patched the flaw and that approximately 3,400 of the roughly 4,000 stolen bitcoins had been returned. That left about 600 BTC—roughly $47 million—still controlled by the hacker at the time of the update. The identity of the attacker has not been publicly disclosed.

Blockstream said Liquid will remain offline until it implements additional fixes and security improvements. The theft is listed on the Rekt leaderboard as one of the largest digital-asset robberies, and the partial recovery highlights both the challenges and the potential for remediation when major crypto infrastructure is targeted.