Cyber thieves siphon $320 million from Bitcoin’s Liquid sidechain, hold onto $47 million in disputed ‘white‑hat’ action

Criminal hackers managed to divert about $320 million in Bitcoin from the Liquid sidechain—a system built to accelerate settlement for traders and exchanges—and then retained $47 million of the loot, labeling the deed as a white‑hat operation.

Run by a group of leading cryptocurrency exchanges, the Liquid Network provides quicker transaction finality and private transfers versus the Bitcoin main chain. Its sizable liquidity and semi‑centralized nature render it a tempting target for perpetrators after sizable, rapid payouts.

Forensic investigators say the attackers took advantage of a flaw that let them initiate illicit withdrawals from several custodial wallets attached to the network. The pilfered coins were routed through multiple mixers and fresh addresses, culminating in a final $47 million batch gathered in wallets that the hackers say they intend to return later.

Labeling the breach as a “white‑hat” exploit has ignited discussion across the crypto community. Though the phrase usually denotes a security researcher who reveals a vulnerability without profit, holding onto a large portion of the funds muddies that definition, keeping the hackers’ “hat color” in doubt.

Clients and institutions that depended on Liquid for high‑value settlements are now evaluating their exposure and pursuing compensation. Exchanges linked to the network have vowed to work with law‑enforcement bodies, while regulators monitor the case closely, highlighting ongoing security weaknesses in layered blockchain architectures.

Investigators will likely pursue the remaining assets using blockchain analytics, and the wider sector may speed up initiatives to reinforce sidechain protocols and enforce tighter custodial safeguards. The incident underscores that even cutting‑edge crypto infrastructures can fall prey to sophisticated assaults, spurring demands for stronger audit standards and clearer guidelines on ethical hacking in the digital‑asset realm.