What actually happened?
Roughly 4,000 BTC worth about $320 million left the federation wallet of the Liquid Network, a Bitcoin sidechain operated by Blockstream. According to Kryptomagazín.cz as well as the Polish outlets Incrypted and CrypS.pl, this represented around 95% of the project's bitcoin reserves.
A sidechain is a separate blockchain network connected to Bitcoin, into which bitcoins are "locked up" while a representation of them is minted on the other side (on Liquid, this is known as L-BTC). Security for such a network is handled by a federation, that is, a group of entities that manage the keys to a shared wallet.
Following the incident, sources say Liquid suspended the network and notified exchanges.
Who is behind it?
The party now controlling the funds has described itself as white hats, meaning ethical hackers who look for vulnerabilities in order to disclose and fix them. According to Incrypted, it has stated its readiness to return the funds once the bug has been fixed. Decrypt reports that Blockstream and the attackers are communicating with each other through PGP-signed messages embedded directly in bitcoin transactions.
Caution is warranted here. The label "white hat" was chosen by the perpetrators of the incident themselves. Whether they truly are ethical hackers, and whether they will return the funds, has not been proven at this point.
Was it a key failure or a code bug?
This is the heart of the story. According to Incrypted, the incident allegedly relates to a consensus bug in the Elements software, the open-source foundation on which Liquid runs, and not to a compromise of the federation keys. The distinction matters:
| Scenario | What it would mean |
|---|---|
| Bug in the code (Elements) | A weakness in the network's rules that can be exploited even without obtaining the private keys |
| Compromise of the federation keys | The attacker gained access to the signing keys of the wallet's custodians |
For now, the publicly communicated version is a bug in Elements, but a detailed technical breakdown is missing from the cited sources.
Why should readers in Central Europe care?
Liquid is not a local Czech project, but the story resonates here too: Kryptomagazín.cz was the first Czech outlet to pick up the incident, in parallel with the Polish sites Incrypted and CrypS.pl. It illustrates a recurring pattern worth watching with any sidechain or bridge: concentrating value in a single federation wallet means that a single consensus bug can jeopardize the vast majority of the collateral.
What to watch for in cases like these in general: whether the team publishes a post-mortem (a technical analysis of the cause), whether there is an actual return of the funds, and how compensation for L-BTC holders will be resolved. All of this remains open for now.
What has been confirmed and what has not
It has been confirmed that around 4,000 BTC left the wallet and that Liquid suspended operations. The motivations of the actors, the exact technical cause, and whether the funds will be returned have not yet been confirmed. We will be able to verify this report later against what actually happens.