Self-described "white-hat" hackers drained roughly $320 million in bitcoin from Blockstream's Liquid Network on Saturday, exploiting a software bug to trick the sidechain into approving a massive, fraudulent payout — and then publicly claimed they meant no harm.

The attackers targeted a flaw in Elements, the open-source software underpinning Liquid, a Bitcoin sidechain used by exchanges to move funds faster and more privately than on Bitcoin's main network. According to Protos, the exploit struck around 14:05 UTC on September 6, minting invalid tokens that the network's automated system couldn't distinguish from the real thing. Roughly 23 minutes later, that fake balance was pushed through a partner exchange service's withdrawal system, and about 4,000 BTC — nearly 95% of the sidechain's total reserves — flowed out to the attackers' wallet.

Network frozen, other assets unaffected

Blockstream moved quickly to contain the damage, halting the Liquid Network, disabling its bridge nodes and instructing partner exchanges to suspend all deposits and withdrawals of the affected token, L-BTC. Other assets that run on Liquid — including tether (USDT) and various tokenized real-world assets — were not touched by the exploit, and Bitcoin's own base blockchain was never at risk, according to Bitcoin.com News.

WE ARE THE GOOD GUYS — MESSAGE POSTED ON-CHAIN BY THE ATTACKERS

In on-chain messages attached to the transactions, the attackers described themselves as ethical hackers and signaled they intend to return most of the funds once Blockstream patches the underlying bug — a pattern seen in several past crypto exploits where attackers use a "white-hat" framing as leverage in return negotiations. Blockstream has published a security contact and said it is in touch with the hackers.

The episode is a fresh reminder of how much trust — and how much risk — is concentrated in the software bridging blockchains to the exchanges that hold customer funds. Liquid has operated since 2018 as one of the older, more established Bitcoin sidechains, making Saturday's breach notable for hitting infrastructure widely considered battle-tested. Whether the attackers follow through on returning the bitcoin, and how much of it, remains unresolved as Blockstream works on a fix before restoring service.