Crypto· Bitcoin

‘White hats’ take 4000 BTC from Liquid, ETFs see best inflows of 2026: Hodler’s Digest

Security researchers claiming to be white hat hackers have extracted approximately 4,000 Bitcoin valued at $319 million from the Liquid Network sidechain, prompting Blockstream to pause bridge operations while investigating the breach. The incident has raised questions about the sidechain's multisig authorization process, though the attackers have not moved or mixed the stolen funds. Separately, US spot Bitcoin ETFs recorded their strongest three-week inflow period of 2026, attracting $3.8 billion as Bitcoin trades near $80,000.

By AI NewsroomPublished about 19 hours agoUpdated about 19 hours ago8 views

Why It Matters

The Liquid Network breach represents a significant security vulnerability for one of Bitcoin's major sidechains and highlights risks in layer-two infrastructure that billions in assets depend on. The concurrent strength in Bitcoin ETF inflows demonstrates institutional appetite remains resilient despite ongoing market uncertainties and security incidents within the crypto ecosystem.

Key Facts

Amount stolen: 3,968 Bitcoin worth approximately $319 million
Liquid federation wallet balance change: Dropped from 4,200 BTC to 207.275 BTC
Bitcoin ETF inflows (3 weeks): $3.8 billion total, with $986.9 million in the most recent week
Current BTC price range: Trading just above $80,000
Total Bitcoin ETF net assets: $101.3 billion as of Friday

The Liquid Network, a Bitcoin sidechain operated by Blockstream, experienced a major security incident when actors claiming to be white hat hackers removed nearly 4,000 Bitcoin from its federation wallet. The perpetrators left an on-chain message stating their intentions and called for direct contact, distinguishing this incident from typical theft scenarios. Blockstream immediately suspended bridge node operations and instructed exchanges to halt deposits and withdrawals on Liquid-backed Bitcoin tokens while the team investigates the breach.

The attack exposed potential vulnerabilities in Liquid's security architecture. The network relies on an 11-of-15 multisignature authorization system to approve withdrawals, and analysis suggests either multiple functionaries signed off on the transaction or the whitelist mechanism designed to prevent such transfers failed. Blockstream later stated that the funds were withdrawn through the SideSwap Peg-out Authorization Key and that a bug in the Elements software created the compromised Liquid Bitcoin in the first place. Notably, the extracted Bitcoin remains unmoved and unmixed on the blockchain, consistent with white hat activity rather than profit-driven theft.

While the Liquid situation unfolded, Bitcoin markets showed continued strength through institutional investment vehicles. US spot Bitcoin ETFs achieved their best three-week performance of 2026, accumulating $3.8 billion in net inflows with the most recent week bringing in $986.9 million. The funds reached a combined net asset value of $101.3 billion, reflecting cumulative inflows of $55.6 billion since inception. Bitcoin's price near $80,000 remained below the 50-week moving average that would traditionally confirm a sustained bull market, yet the ETF inflows suggest institutional participants are positioning themselves despite ongoing uncertainties in the cryptocurrency landscape.