Ledger CTO questions Liquid Network whitehats claim after about 4,000 BTC peg-out

On Sept. 6, 2026, Ledger CTO Charles Guillemet said about 4,000 BTC were pegged out of Blockstream’s Liquid bridge, with an OP_RETURN message stating “we are whitehats. contact us on chain.” Bitcoin Magazine also reported that the Liquid Network said Sunday that there were purported “white-hat” hackers withdrawing 4,000 bitcoin from Blockstream’s Liquid Network Federation reserves ^{[1] [2]}.

Guillemet argued that “white hats” would not drain a bridge and then solicit contact on-chain, and he compared the situation to the Ronin hack (where validator-key compromise was used to steal roughly $625 million) and to the approach used by the Euler attacker to negotiate a return of funds after an exploit ^[1].

Blockstream responded on-chain, asking the party to contact its security team. Blockonomi separately reported that Liquid said the peg-out used SideSwap’s PAK and that the key itself and other authorization keys stayed secure, while also noting the transfer involved about 3,996 BTC and represented roughly 95% of Liquid’s Bitcoin reserves ^{[1] [3]}.

Other outlets reported different figures for the drained/peg-out amounts: Crypto Briefing characterized it as an incident involving ~4,200 BTC (valued at about $320M). Bitcoin.com News described it as nearly 4,000 BTC drained from Blockstream’s Liquid peg ^{[4] [5]}.