Hackers drained $320 million from the Liquid Network blockchain on Sunday, the latest breach to expose fragile custody assumptions in Bitcoin-adjacent infrastructure. The federation sidechain, which settles transactions through a permissioned group of functionaries rather than proof-of-work, paused new deposits and withdrawals while members coordinate a response.
The breach and the message
In a post on X dated September 6, Liquid Network described the actors as “purported white-hat hackers”, a label that in practice covers anyone who breaches a system first and negotiates return terms after. The project acknowledged wallet impacts and apologized for inconvenience. On-chain, the attacker has been messaging maintainers through Bitcoin transaction metadata, demanding that the code vulnerability be patched across every node before any funds move back. “Please fix the bug first,” one message read, according to CoinDesk on September 7. “The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix.”
A pattern of infrastructure failures
The incident sits inside a cluster of custody failures. Last week a hacker extracted $6 million from the lending protocol Tectonic. In August, attackers exploited outdated firmware on Coldcard hardware wallets manufactured by Coinkite, with loss estimates ranging from $115 million to $130 million. Each case traces to a different layer, smart contract, firmware, federation logic, but the common thread is software that moved value before it was proven resilient.
What the industry says
Ziqing Ang, who leads Asia-Pacific policy at TRM Labs, told Bloomberg on Sunday that the string of events shakes consumer confidence while simultaneously mapping where critical infrastructure safeguards need reinforcement. The argument is that full-stack security becomes essential for operators when any single layer can become an exit door.
The banking angle
A Financial Crimes Enforcement Network analysis released last week pointed to an underused advantage banks hold in authorized-payment scams: visibility into the funding sequence before the final crypto transfer occurs. PYMNTS described the pattern on September 4, retirement accounts liquidated, home-equity lines drawn, personal loans originated, then a wire to an exchange or unfamiliar beneficiary. Viewed in isolation each step looks legitimate; viewed as a sequence the customer appears to be liquidating their financial life to fund a scam.
What to watch
Liquid’s federation members say they are working to restore normal activity. The immediate test is whether the attacker returns the $320 million once a patch is deployed and verified across the network. A secondary test is whether the federation publishes a full accounting of which wallets were affected, how the vulnerability existed in the latest commit, and what governance changes follow. Until then, the sidechain’s pegged bitcoin remains immobilized, observable on-chain, unverified in custody.