‘We Are Whitehats’: Nearly 4,000 BTC Drained From Blockstream’s Liquid Peg

Liquid’s Bitcoin Peg Plunges From Roughly 4,200 BTC to 207 BTC

Onchain researcher Ergo BTC flagged two linked bitcoin transactions, including a large Liquid peg-out described as roughly 4,000 BTC leaving a pool of about 4,200 BTC. A follow-up transaction spent approximately 3,998.5 BTC and included the “whitehats” message. Blockstream’s Liquid explorer subsequently showed federation holdings of just 207.275 BTC, a significant drop from the roughly 4,200 BTC that had backed the network for months.

Image source: X

The move is drawing a great deal of attention because Liquid’s peg-out system is not designed to let anyone simply pull bitcoin from the sidechain. Normally, LBTC is destroyed on Liquid before federation functionaries process the corresponding bitcoin withdrawal.

Image source: Blockstream.info.

Mainchain funds require an 11-of-15 federation multisignature, while the Peg-out Authorization Key system is intended to restrict payments to approved member wallets. Right now, how all of this happened is quite a mystery.

‘Whitehats’ Claim Leaves Liquid Facing a Big Unanswered Question

What happened behind the scenes is anyone’s guess. There are possibilities to this particular security issue, including a compromised whitelisted wallet, abuse involving Liquid’s security mechanisms, or a coordinated white-hat extraction intended to protect funds after discovering a vulnerability. None has been confirmed. Treating the “whitehat” message as proof of good intentions would be jumping ahead of the evidence as well.

Nearly 4,000 BTC Remains Concentrated as Liquid Users Await Answers

For now, the bitcoin (BTC) is reportedly concentrated on the Bitcoin blockchain and had not obviously been mixed at the time of writing. The next significant development will be whether Blockstream or Liquid confirms an incident, explains why the reserve collapsed from roughly 4,200 BTC to 207 BTC, or responds through the onchain channel apparently opened by the unidentified party.

Until the dust settles, the cause of the massive transfer remains unconfirmed. This story is still developing.