$319 million stolen, then the hackers wrote on the blockchain
Listen to the audio version
On September 6, 2026, a network built on top of Bitcoin had the equivalent of $319 million stolen from it in a matter of minutes. What makes this incident unusual isn't just the amount: it's how the attackers then negotiated their exit, directly on the blockchain, in plain sight of everyone.
What happened
The network involved is called Liquid Network, a system developed by the company Blockstream and built on top of Bitcoin (see the article on blockchain to understand the general principle). At 13:53 UTC, attackers exploited a flaw in how the software verified certain internal cryptographic proofs, a mechanism meant to guarantee that no unit is created without real backing. This verification gap let them have 4,000 bitcoins created directly on the network, without depositing a single real bitcoin in exchange.
Thirteen minutes later, the attackers were already requesting to convert those funds through an exchange. Twenty-two minutes after that request, barely 36 minutes after the fraudulent creation, the 4,000 stolen bitcoins (about $319 million at the time) had left the network.
How the attackers communicated directly on the blockchain
This is the most unusual part of the whole affair. A Bitcoin transaction can carry, alongside an amount and a destination, a small optional field called OP_RETURN, able to hold up to 80 bytes of arbitrary data, including text. This field has no effect on the funds being transferred: it's simply a public space where anyone can write a message, visible to anyone who looks up the blockchain.
The attackers used it to write, in plain text: "we are whitehats. contact us on chain." A whitehat, or ethical hacker, normally refers to someone who reports a flaw to get it fixed, rather than exploiting it for profit.
Blockstream's team replied the same way. The screenshot above shows one of these actual transactions, viewable by anyone on a public block explorer (transaction `91271efcbb5ab29abfc38ae635f0644e3ba042aad56f92d40136e1dde4742fe8`, on September 6, 2026 at 21:31 UTC): "Please contact [email protected]." The exchanges that followed continued as encrypted, then PGP-signed messages, inserted into further successive transactions: an entire negotiation carried out publicly, with no email and no private channel.
It's worth noting that calling yourself a "whitehat" after already extracting the funds remains a claim made by the attackers, not a verified status: the line between a security researcher negotiating a reward after the fact and outright theft dressed up with a after-the-fact justification depends largely on what happens next, not on the message itself.
A partial return, and a share still in dispute
The next day, September 7, the attackers returned about 3,400 of the 4,000 stolen bitcoins, nearly 85% of the total amount, worth around $272 million. The remaining 598.5 bitcoins, around $47 million, stayed in their hands: they're claiming them as a reward for disclosing the flaw rather than exploiting it further or selling it to someone else.
This pattern, a partial return of funds presented as a deserved "bounty," has become a recurring theme in major crypto hacks over the past few years: it puts the attacked network in a difficult position, accept the partial loss and avoid a long, uncertain legal fight, or refuse and risk never recovering anything at all.
Why this isn't the kind of hack already seen on this site
The articles on phishing or crypto scams (see the dedicated article) describe attacks that target a person: stealing a password, a recovery phrase, or tricking someone into authorizing a transaction. Nothing like that here. Nobody was deceived, no individual wallet was compromised (see the article on wallets for the difference). The flaw sat directly in the network's own verification logic, a bug in the code that even an experienced team like Blockstream's hadn't caught before it was exploited.
It's a useful reminder: a crypto system's security doesn't depend only on its users' caution. An entire protocol can hold a flaw invisible for years, until someone finds it, whether their intentions are good or not.