Protocol attack report VR-717BCCC5
Investigator report
Filed by a vetted PublicAML investigator rather than by an anonymous reader. The account itself has not been independently re-checked.
The addresses below carry a risk label from this report, except those marked victim or mentioned - naming one of those is not an accusation and does not move its score.
- Type
- Hack
- Reported as
- Protocol attack
- Chain
- bitcoin
- Reported by
- DenysInvestigator
- Incident date
- Sep 7, 2026
- Published
- Sep 8, 2026
What happened
Liquid Network (Liquid Federation) protocol exploit, 7 September 2026. An Elements minting bug allowed the creation of unbacked L-BTC, which was then routed out through SideSwap's peg-out. Federation keys were not compromised and the transaction appeared valid — this was a protocol-level flaw, not a key compromise. Approximately 4,000 BTC (~$320M at the time) was siphoned from the Liquid Federation wallet and consolidated into bc1ql4mfu6aundtkksxklfajs2h3t9nzcd6gyqjlte. The party left an on-chain message reading "we are whitehats. contact us on chain." On 8 September 2026 roughly 3,400 BTC (~$315M) was returned, while 598.5 BTC (~$47.4M) was retained at the same address and has not been returned. Reported by PeckShieldAlert on X, 7 September 2026. This report is filed by PublicAML from public sources, not by a victim of the incident. The address is recorded as the consolidation point of exploited funds; the "whitehat" claim is the actor's own and is not independently verified.
Addresses named in this report
- bc1ql4mfu6aundtkksxklfajs2h3t9nzcd6gyqjltePerpetrator
Named here and believe it is wrong? Open the address page above and use the flag on the assessment. Every dispute is read.