On September 7, 2026, a Bitcoin sidechain originally designed to provide faster and more private asset transfers for exchanges and professional traders was thrust into the spotlight due to an unexpected security incident. Alex Thorn, the head of research at Galaxy, disclosed on social media that the Liquid Network, launched by Blockstream, had exposed a significant vulnerability, with a self-proclaimed white hat hacker reportedly taking control of approximately 4000 BTC through this flaw. Unlike the common “hack and run” scenario, this time the offensive and defensive play was placed on a stage for open examination from the very start—the white hat chose not to completely hide but rather responded to the project team through the OP_RETURN field of the Bitcoin main chain with PGP encrypted text, leaving a traceable negotiation footprint; at Bitcoin block height 965822, a 1000 satoshi transaction sent from an address associated with Blockstream carried OP_RETURN information used as a starting point for public communication. According to reports from several industry sources citing a single source, the two parties engaged in a dialogue on the blockchain regarding vulnerability fixes and asset disposal. The white hat stated in the message that they would return “most” of the controlled BTC after the Liquid vulnerability fix was completed, but did not provide a clear percentage or timeline, while Blockstream has yet to release a detailed technical report or complete explanation. In the absence of details and between the blank slate of uncertainty and the visible commitments on-chain, the confrontation that unfolded between the sidechain and the white hat quickly escalated into a public game of trust: Liquid must persuade coin holders to continue believing in the security narrative of this sidechain, while the white hat needs the market to accept that “temporarily hijacking assets and returning them afterwards” is, in itself, a trustworthy security practice.

4000 BTC White Hat Entering Liquid

Around September 7, 2026, the Liquid Network was revealed to have a major security vulnerability, with a self-proclaimed white hat hacker reportedly taking control of approximately 4000 BTC through this unreleased flaw. Liquid, as a Bitcoin sidechain launched by Blockstream, has long provided a faster and more private asset transfer channel for exchanges and professional traders, but now found itself with a single participant “gripping” the core assets, which outlines the basic contours of the event: it is not a corner feature that has been bypassed, but rather, a vulnerability has emerged in the asset control hierarchy that could shake the trust foundation of the entire sidechain.

In the public materials, the approximately 4000 BTC mentioned is only a range concept; the specific precise amount, where these assets were originally distributed among which accounts, and whether there is a possibility of reusing the same vulnerability multiple times have yet to be clarified by the project team. Large assets concentrated under white hat control inherently belong to a rare high-risk scenario, and as the attack vector, affected scope, and subsequent fix path remain murky or even silent, the information asymmetry is rapidly amplified. The outside world can only piece together the truth from the scattered communication records and sporadic disclosures on-chain, and anxiety about the security boundaries of Liquid continues to rise.

OP_RETURN Messages and PGP Encrypted Letters

According to AiCoin data, at Bitcoin block height 965822 (according to a single source), an address associated with Blockstream sent a transaction of only 1000 satoshis but included critical information in the OP_RETURN field. This type of field originally only allows for a small amount of text to be embedded but has been widely used as an on-chain announcement and proof tool; at this moment, it served as a form of “public reply”: the amount is negligible, but the real weight lies in the text left on the Bitcoin main chain, signaling to the white hat and announcing to all onlookers that negotiations have begun, setting timestamps and accountability coordinates for every subsequent communication.

Unlike the open OP_RETURN, the two parties later chose to continue in-depth communication using PGP encrypted text, concealing the specifics of their negotiations within the ciphertext and broadcasting via public channels. Only the party holding the corresponding private key can interpret these encrypted letters, but anyone can verify that the signature comes from the same entity. This design finds a narrow path between “visible to the entire network” and “negotiation confidentiality”: every on-chain message and ciphertext exchange is recorded, providing a complete set of traceable on-chain evidence and a narrative framework for future tracking of whether the white hat returns “most” BTC as promised and for clarifying the responsibilities borne by both the project team and the white hat.

Trust Game Between White Hat and Project Team

The on-chain encrypted conversation provides a rare and clear evidence chain for this negotiation, but it does not outline a similarly clear picture for the “outcome.” The white hat committed in the OP_RETURN and PGP texts to returning “most” BTC after the vulnerability fix is completed, but this expression is deliberately left vague: it presents neither a proportion nor a timeline and does not specify a concrete execution path. For Liquid users and the broader Bitcoin community, “most” semantically creates an ambiguous expectation—appearing to be a promise of security while simultaneously preserving the white hat's space to retain some leverage; market sentiment oscillates between “at least it won’t be a total loss” and “how much will actually be lost,” and anxiety thus grows.

With the white hat's true identity, past records, and potential motives completely blank, the project team chooses to negotiate on-chain rather than engage in public confrontation, which also involves a calculation of reality. The currently visible information mainly comes from the disclosures of Galaxy's head of research Alex Thorn and media reports, while Blockstream has yet to issue a detailed official statement, making it impossible for the outside world to confirm its specific plans regarding technical rectification and legal responsibility. Under this asymmetry of information, adopting a hard public stance could potentially provoke this unknown entity controlling approximately 4000 BTC to make more radical choices, whereas maintaining communication through on-chain encrypted letters to buy time for the vulnerability fix emerged as a more feasible compromise. The community, on one hand, has to rely on this self-proclaimed white hat to reveal the vulnerability and temporarily “safeguard” the controlled assets; on the other hand, it cannot ignore the fact that under the absence of verifiable background information and legal constraints, this “white hat” label is currently just a self-declaration, and whether it will be redeemed with restraint and return in practice remains the sharpest and hardest question to answer in the Liquid trust narrative.

Shattering the Myth of Sidechain Security

When a network that has long identified itself as “a fast settlement and privacy sidechain for exchanges and professional traders” suddenly exposes that approximately 4000 BTC is under single-point control on-chain, the core selling point of the Liquid Network is effectively reversed and scrutinized. In the past, “Bitcoin sidechains operated by trusted custodians and mature companies” were packaged as a gentle supplement to the native chain's scalability, with security seemingly a default premise built into the architecture; this time, the white hat directly grasped the life-and-death power over the sidechain's held assets through the vulnerability, turning the centralized custody risk inherent in the sidechain model from abstract discussions in technical reports into a digital reality pressure test that can be counted. The so-called psychological security threshold rapidly collapses before the series of “4000 BTC” numbers, forcing users to ask again: do I trust the code, the custodial alliance, or that company which dominates the brand narrative?

This impact goes beyond mere crisis public relations for Blockstream’s product line. As a key voice in Bitcoin's scaling path, Blockstream has long played a rational technocratic role in the narrative of “cautious expansion and sidechain experimentation,” yet now reveals an unexplained major vulnerability in its own created sidechain, inevitably weakening its moral high ground in subsequent debates over expansion plans. More sensitive is the role of the white hat itself: past white hat actions in the crypto industry have generally taken place within the limits of limited bounties, rapid disclosures, and prompt returns, and the market’s expectations for their moral discipline have never been stretched to the limits of thousands of BTC levels. When the scale of the controlled assets expands to a degree that can sway the trust outlook of the entire sidechain, the phrase “we rely on the white hat's goodwill” suddenly seems extraordinarily fragile, compelling all participants to acknowledge an unpleasant reality: if a set of security commitments ultimately relies on individual virtue, then regardless of how many technical white papers it is written into, it is fundamentally just a narrative that has not yet been tested to the extreme by reality.

Watch List After the Promise of Return

Following the white hat’s public commitment to “return most BTC post-fix,” the only three types of variables truly worthy of continuous observation actually are: the first is the technical closure of the vulnerability itself: the details regarding the timeline for repairs, patching plans, and whether to introduce third-party audits remain undisclosed; whether Liquid Network and Blockstream choose to self-repair quickly or grant more verification power to external experts will be directly recorded in subsequent technical announcements. The second is the on-chain rhythm and pathway for asset return: the actual proportion of BTC returned by the white hat, specific time points, and which custodial or multisig structure these BTC flow back to from the attack control address will all leave verifiable tracks on the Bitcoin chain, and these facts will shape the credibility of their “white hat” identity more powerfully than any self-declaration. The third is the completeness and sincerity of information disclosure: so far, Alex Thorn, the head of research at Galaxy, remains the main entry point for the outside world to understand the incident, while Blockstream has yet to issue a detailed post-event report and technical review; whether Liquid can proactively address the causes of the vulnerability, scope of affected accounts, and governance decision processes afterwards will impact the community’s long-term assessment of its transparency and accountability. In this phase, where single sources dominate and key information is lacking, readers need to deliberately separate “white hat self-narrative” from genuine risk assessment, directing attention to independently verifiable address behaviors and official documents; this incident may also prompt the entire Bitcoin sidechain ecosystem to re-examine the design boundaries of security governance and white hat cooperation mechanisms. These three variables will determine whether Liquid's current trust crisis is ultimately viewed as a successful upgrade in security governance or as a white hat experiment exposing structural flaws.

Join our community, let’s discuss and become stronger together!
AiCoin exclusive Hyperliquid benefits: https://app.hyperliquid.xyz/join/AICOIN88
AiCoin exclusive Aster benefits: https://www.asterdex.com/zh-CN/referral/9C50e2
On-chain Telegram community: https://t.me/AiCoinWhaleData
On-chain community: https://www.aicoin.com/link/chat?cid=N6OVMor5g
AiCoin on-chain Twitter: https://x.com/aicoinwhaledata

免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。