Liquid's Attackers Called Themselves White Hats, Ledger's CTO Isn't Buying It

Ledger's Chief Technology Officer has questioned the white hat label attached to the $320 million taken from Liquid Network.

He stopped short of calling it a theft. Liquid described the parties as purported white hat hackers, and Blockstream is trying to reach them on-chain.

For context, Liquid is a Bitcoin (BTC) layer-2 network that operates as a separate blockchain. It uses a two-way peg to connect Bitcoin with its native Liquid Bitcoin (L-BTC) asset.

Users lock Bitcoin on the main network to receive an equivalent amount of L-BTC on Liquid. They can later redeem L-BTC for Bitcoin through the network's peg-out process.

In an X post, the team stated that roughly 4,000 Bitcoin left the Liquid Federation wallet. Liquid said the transfer used the SideSwap Peg-out Authorization Key, which it insists was not compromised.

SideSwap explained that a customer sent 4,000 LBTC to its peg-out service at 14:05 UTC, and the federation paid out 3,996 BTC 23 minutes later. Blockstream has since traced that LBTC to a bug in the Elements software, according to the company.

The funds were consolidated into the Bitcoin address bc1ql4mfu6aundtkksxklfajs2h3t9nzcd6gyqjlte. It contained an on-chain message claiming the actors were white hats.

The message also asked Liquid to contact them on-chain. Galaxy Research estimated the funds represented about 95% of all Bitcoin pegged to Liquid.

In response, the network disabled bridge nodes, preventing new transactions from entering the chain.

Liquid also notified exchanges, which have paused or are preparing to pause L-BTC deposits and withdrawals. Other Liquid assets, including USDT, DePix, and real-world assets, remain unaffected by the incident.

"Liquid wallets will be impacted, and we're sorry for any inconvenience. Federation members are actively working on resolving this so we can restore normal network activity," the team said.

Charles Guillemet, chief technology officer at Ledger, questioned that description. He compared the episode to the Ronin hack, in which attackers stole about $625 million after compromising validator keys. He also linked the invitation to talk to Euler.

4,000 BTC just pegged out of the Liquid bridge. The OP_RETURN says "we are whitehats. contact us on chain." White hats don't drain a bridge and then solicit an "on-chain" contact. This echoes the Ronin hack, where attackers compromised validator keys to steal ~$625M.

Guillemet later softened his reading. The conduct does not look like usual white hat practice, he wrote, though criminal groups do not usually try to contact their victims either.

"There's hope. This could be people with good intentions that intensively played with recent LLMs and are not used to responsible disclosures...," the executive noted.

As of press time, the coins have not left the address that received them. Public records show it still holds about 3,998 BTC, while the federation wallet retains roughly 197 BTC.

Early Monday, the same address signed another message. It asked whether sending most of the funds back to the federation wallet would be acceptable.

Whether Guillemet's doubts hold depends on what the address does next, not on what it writes.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.