A significant security incident on the Liquid Network — Blockstream's Bitcoin sidechain — moved closer to resolution this week, though not completely. Self-described whitehat hackers who drained roughly 4,000 BTC from Liquid's federation wallet on Sunday have returned 3,400 of those coins, according to reporting from Bitcoin Magazine and CoinDesk. About 598.5 BTC, worth nearly $47 million at current prices, remains at the holder's address.
Blockstream communicated with the actors directly through on-chain messages, confirming that the bridge nodes exploited in the breach had been patched. That disclosure appeared to trigger the partial return. Whether the remaining coins come back depends on negotiations still underway.
What Happened on Liquid
Liquid is a federated sidechain that lets users move Bitcoin faster and with more privacy than the base layer allows. Its security model relies on a set of functionaries — essentially trusted nodes — rather than Bitcoin's open proof-of-work consensus. That federated structure is what was compromised.
The actors described themselves as whitehats, implying they exploited the vulnerability to expose it rather than for profit. The fact that they returned 85% of the funds lends some credibility to that framing, though nearly $47 million in bitcoin is still outstanding, and that cannot be glossed over. A genuine whitehat disclosure typically does not involve holding funds as leverage.
Blockstream has not yet published a full post-mortem, but the network restart is being prepared as patched nodes come back online, per Decrypt.
Why Custody Architecture Matters Here
This incident is a useful reminder that not all Bitcoin storage carries the same risk profile. Liquid's federated model requires trusting a specific set of participants. If any node in that federation is compromised — or if the protocol layer itself has a flaw — funds held on the sidechain are exposed in ways that a cold-storage setup on the Bitcoin base layer would not be.
That does not make Liquid worthless. Speed and privacy tradeoffs are real and useful. But users and institutions moving large amounts of BTC through any second-layer or federated system should understand what they are trusting and why.
Elsewhere: Strategy Pauses Buying, Capital B Adds 376 BTC
On the institutional side, Strategy skipped its usual Bitcoin purchase this week, instead repurchasing $176 million of its STRC preferred shares and doubling its digital securities repurchase program to $2 billion, according to Cointelegraph. Strategy still holds roughly 4% of Bitcoin's total capped supply, worth around $66 billion.
Meanwhile, French company Capital B added 376 BTC in a $29 million purchase — its largest buy in nearly a year — pushing its total holdings to 3,521 BTC, per Cointelegraph. That move places Capital B ahead of H100 Group among European publicly traded Bitcoin holders.
Bitcoin itself is trading near $78,405, down slightly on the day, with volatility remaining subdued. More than 71% of the circulating supply is currently in profit, a level that analysts at Bitfinex say has historically marked the boundary between bear and bull market conditions.
Security events like the Liquid breach are a good reason to think carefully about custody before moving funds anywhere — including to a charity. Donating directly on-chain to a vetted organization, with clear wallet transparency, keeps the trust model simple and the risks low.