‘We Are Whitehats’: Nearly 4,000 BTC Drained From Blockstream’s Liquid Peg

Actors claiming to be “whitehats” drained nearly 4,000 BTC from Blockstream’s Liquid peg and moved the coins to addresses under their control, saying the operation was intended to highlight or secure a vulnerability. The group’s motives and whether funds will be returned remain unclear, creating ambiguity around attribution and remediation. The incident highlights material security and custodial risks in Liquid’s federated peg model and undermines confidence in third‑party sidechain custody. For Bitcoin, this raises counterparty and systemic‑risk concerns that could accelerate demand for native on‑chain custody and trustless bridge solutions.