Liquid Network Federation Wallet Drained of 4000 BTC in Alleged White-Hat Exploit Exposing L-BTC Minting Flaw
On September 7, the Liquid Network Bitcoin sidechain was hit by an attack that drained its Federation wallet of roughly 4000 Bitcoin, valued at approximately $320 million or 2.1 billion RMB, leaving only about 200 BTC in reserves. This represented a 95% loss of the network's backing assets overnight.
The incident was first noticed through an official post on X confirming that the Liquid Federation wallet had been compromised. Funds were transferred out via the authorized SideSwap settlement platform, yet Liquid emphasized that SideSwap keys remained secure and that the PAK (Pegin Authorization Key) itself was not leaked.
Security researchers, including FailSafe CEO Aneirin Flynn, identified preliminary evidence pointing to a vulnerability that permitted unauthorized minting of L-BTC. In the Liquid Network model, L-BTC is issued 1:1 against locked Bitcoin held in the federation wallet; any flaw allowing free minting of L-BTC effectively lets an attacker exchange phantom assets for real Bitcoin.
Officials described the perpetrator as a claimed white-hat hacker who allegedly planned to return the funds in exchange for a fee. This narrative echoes past cases such as the 2021 Poly Network incident, where $610 million was moved and later largely returned, though many similar events end with permanent loss.
The attack has forced Liquid to suspend all new transactions while federation members, including major exchanges BTSE, Bitfinex, and BitMEX, work on remediation. The event highlights a shift in 2026 crypto threats from stealing private keys to compromising asset-issuance and consensus logic, evidenced by the recent Coldcard random-number-generation flaw that enabled theft of over 1755 BTC.
Industry data for the first half of 2026 already records $972 million stolen across 207 incidents, marking a record half-year high. Experts warn that the Liquid case exposes fatal gaps in verification mechanisms and multi-signature federation controls that traditional audits often overlook.
Related articles
French Bank Crédit Mutuel Arkéa Confirms Cyberattack with Blockchain Investigation Estimating $133 Million in Losses
Crédit Mutuel Arkéa has confirmed a cyberattack that enabled fraudulent transactions, though the bank provided no official figures on the financial impact. Blockchain investigator ZachXBT traced more than $106 million moved on November 1 and an additional $27 million, bringing the total beyond $133 million. The funds originated in USDC and USDT, were converted to Ethereum, moved across multiple blockchains, and ultimately exchanged for Monero to hinder tracking. The bank stated that customer assets remained unaffected, operations were gradually restored, and authorities were notified, while warning clients against phishing attempts tied to the incident. Reports have linked the breach to the group's digital bank Fortuneo, a connection the institution has not confirmed. The case highlights how blockchain analysis can reveal the scale of financial crime before official disclosures from the victim.
Binance Hit by Record $6.3 Billion Theft After Engineer Laptop Compromise
Binance suffered what could become the largest crypto theft in history, with approximately $6.3 billion in assets drained from exchange wallets over three days in late October. On-chain analysts at Arkham and Glassnode first detected the movement of $5.3 billion, including $1.66 billion in USDT, 17,985 ETH worth $1.45 billion, and $767 million in USDC. Binance confirmed the incident, halted deposits and withdrawals, froze around $3 billion on-chain with law enforcement and partners, and pledged to cover all losses from its SAFU fund. The root cause was traced to a compromised laptop belonging to a development operations engineer, allowing attackers to access a service container and issue authorized-looking withdrawal transactions without any private key exposure. The attack bypassed traditional cold wallet protections by impersonating legitimate privileged access rather than stealing cryptographic keys. Industry observers note this highlights systemic risks in developer endpoint security, long-lived credentials, and control-plane protections across exchanges.
Mercado Bitcoin Freezes $11 Million After Hacker Drains Hot Wallets Across Multiple Chains
Mercado Bitcoin detected a security incident in the early hours of November 2, 2026, and quickly blocked approximately $11 million in assets to prevent further losses. The exchange confirmed that hot wallets connected to the internet were targeted, allowing unauthorized transactions to spread funds across 17 different networks. Chainalysis, Arkham, and several stablecoin issuers including Tether, Circle, and Paxos collaborated to freeze around $10 million, primarily in stablecoins. The company stated that no customer funds were lost and no data was leaked, though the exact method used by the attackers remains undisclosed. Different analytics firms reported varying totals, with estimates ranging from $38 million to $49 million in total movement. Mercado Bitcoin has committed to absorbing identified losses and restoring services only after full security is ensured.
Scammer Leverages Unstoppable Domains to Redirect ATOM Transfers via Fake IBC Address
A journalist investigating a Telegram crypto investment pitch discovered an elaborate social engineering scheme that abused Unstoppable Domains. The scammer instructed the target to append -ibc.x to a shared Bybit XRP deposit address, causing the Edge wallet to resolve the string as a Web3 domain pointing to an attacker-controlled Cosmos address. The technique exploited Bybit’s shared deposit infrastructure and the wallet’s native support for Unstoppable Domains records. Analysis of the receiving Cosmos wallet showed 147 incoming ATOM transactions totaling more than 22,000 tokens between July and October. The author subsequently registered several .x and .crypto domains to demonstrate legitimate use of the same resolution mechanism in Edge, Trust Wallet, and OKX Wallet.