Hackers Seize $320 Million from Bitcoin’s Liquid Network, Hold $47 Million Claiming ‘White‑Hat’ Motive

A group of cyber‑criminals managed to divert about $320 million in Bitcoin from the Liquid sidechain—a system built to accelerate settlement for traders and exchanges—and then retained $47 million of the loot, labeling the maneuver a white‑hat operation.

Run by a coalition of leading cryptocurrency exchanges, the Liquid Network provides quicker transaction finality and private transfers relative to the Bitcoin main chain. Because of its substantial liquidity and semi‑centralized nature, it presents a tempting target for attackers after sizable, rapid payouts.

Forensic investigators say the thieves took advantage of a flaw that let them initiate unauthorized withdrawals from several custodial wallets tied to the network. The pilfered coins were routed through multiple mixing services and fresh addresses, culminating in a final $47 million bundle placed in wallets the hackers say they intend to give back later.

Labeling the breach as a “white‑hat” intrusion has ignited discussion across the crypto sphere. Though the phrase usually denotes a security researcher who reveals a vulnerability without profit, holding onto a large portion of the loot muddies that definition, keeping the hackers’ true “hat color” in doubt.

Clients and institutions that depended on Liquid for high‑value settlements are now evaluating their exposure and demanding compensation. Exchanges linked to the network have vowed to work with law‑enforcement bodies, while regulators monitor the case closely, highlighting ongoing security weaknesses in layered blockchain architectures.

Authorities are set to pursue the remaining assets using blockchain analytics, and the wider sector may speed up initiatives to reinforce sidechain protocols and impose tighter custodial safeguards. The incident underscores that even sophisticated crypto infrastructures can fall prey to advanced attacks, spurring demands for stronger audit regimes and clearer standards for ethical hacking in the digital‑asset realm.