Two separate Bitcoin security incidents dominated the weekend, and neither is fully resolved. Together they raise a pointed question about custody infrastructure that custodians, exchanges, and individual holders should be sitting with right now.
The Liquid Network Drain
On Saturday, actors identifying themselves as white-hat hackers withdrew approximately 4,000 BTC — worth roughly $320 million — from the federation wallet that backs Liquid's L-BTC token. According to Bitcoin Magazine and Cointelegraph, Blockstream confirmed the withdrawal and immediately disabled bridge nodes, pausing the entire sidechain. No transactions can currently move on Liquid.
The hackers' stated motivation: a vulnerability in Elements, the open-source software underlying Liquid. They communicated with Blockstream through PGP-signed messages embedded in Bitcoin transactions — an unusual channel that Blockstream has publicly acknowledged. According to CoinDesk, the two parties are now in active dialogue. The hackers say they will return most of the 4,000 BTC once the bug is patched across the network.
"Most" is doing a lot of work in that sentence. Blockstream has not specified what portion it expects back, or when. Exchanges that rely on Liquid for settlement are effectively frozen in the meantime.
Whether the actors are genuinely white-hat or opportunistic remains unconfirmed. Taking funds first and negotiating terms afterward is not standard responsible disclosure practice, regardless of intent.
The Coldcard Exploiter Keeps Moving
Separately, the attacker behind the so-called Wave 3 Coldcard thefts moved another $7.7 million in BTC over the weekend — about 45% of the funds stolen in that attack wave. According to CoinDesk and Decrypt, citing Galaxy Research, the attacker originally spread the stolen bitcoin across 293 separate vaults and is emptying them in order of size, largest first. As of mid-August, Galaxy had identified roughly 1,779 BTC stolen from 190 victims across more than 8,600 addresses.
The methodical vault-draining pattern suggests the attacker is experienced and unhurried. There is no indication of recovery efforts yielding results.
Why Both Stories Matter Together
These two incidents hit different layers of the Bitcoin stack. Liquid is a federated sidechain used primarily by exchanges and traders who need faster settlement than the base layer offers. Coldcard is a hardware wallet aimed at self-custody holders. The fact that both were compromised — or exploited — within the same news cycle is a reminder that no single tool or layer is automatically safe.
- Liquid's risk is federated: a small group of entities controls the multisig backing L-BTC, making the federation wallet a high-value target.
- Coldcard's risk, in the Wave 3 attacks, appears tied to specific key-generation or storage practices among affected users, though the full technical picture is still emerging.
Meanwhile, Bitcoin itself is trading near $79,574, down about 1.1% since midnight UTC, according to CoinDesk. Spot ETFs pulled in $987 million last week alone, per The Block, suggesting institutional demand has not meaningfully reacted to either incident — at least not yet.
For anyone using Liquid-based services, the immediate practical step is to confirm with your exchange whether withdrawals or settlements are affected. For hardware wallet holders, now is a reasonable time to review your key-generation records and storage practices, regardless of which device you use.
Charitable giving in Bitcoin operates on the base layer, which remained fully functional throughout both incidents. When donors send BTC directly to a vetted charity, there is no sidechain or federated intermediary between the sender and the recipient.