A reported “white hat” actor has taken nearly 4,000 Bitcoin worth about $319 million from the Liquid Network, according to an incident update posted by the Blockstream-run sidechain community. Liquid subsequently paused bridge operations and asked exchanges to stop both LBTC deposits and withdrawals while it investigates what went wrong.

Liquid Network says the withdrawal was executed via SideSwap using a Peg-out Authorization Key, while insisting that the key used was not compromised. Still, the federation wallet balance shown in Liquid’s explorer dropped sharply—from roughly 4,200 BTC to about 207.275 BTC—prompting renewed scrutiny of how Liquid’s peg security functions when something unusual bypasses expected controls.

Key takeaways

• Liquid says bridge nodes were disabled temporarily, effectively pausing the Liquid sidechain until the issue is resolved.
• The incident involved an LBTC peg-out executed through SideSwap, with Liquid stating the Peg-out Authorization Key was not compromised.
• Liquid told exchanges to pause LBTC deposits and withdrawals while the team attempts to contact the actor and assess security gaps.
• An OP_RETURN message claimed the funds were extracted by “whitehats,” but neither the claim nor the technical details are fully verified publicly.

Liquid freezes bridge activity after a major LBTC outflow

According to the initial reporting in Liquid Network’s incident communications, a “shade under 4000 Bitcoin” worth approximately $319 million was withdrawn from Liquid. Liquid Network also referenced an unverified on-chain message—via OP_RETURN—asserting responsibility and asking to be contacted “on chain.”

In response, Liquid disabled bridge nodes, stating this stops any new transactions from being submitted to the network. The operational consequence is straightforward: without bridge nodes, the sidechain’s peg mechanics can’t continue normally, which is exactly what traders and exchanges need when a suspected peg-out route may be functioning unexpectedly.

“Bridge nodes have been temporarily disabled, so no new transactions can be submitted to the network. Effectively, the Liquid sidechain is paused until this issue is resolved.”

How Liquid’s peg-out is supposed to work—and what the incident challenges

Under standard Liquid mechanics, LBTC is burned on the sidechain before Bitcoin is released on the main chain. The withdrawal flow depends on authorization rules that require a multisignature setup (Liquid describes this as 11-of-15 multisig functionaries) and a whitelist for approvals.

That structure is meant to prevent exactly the kind of unauthorized peg-out that would drain funds from the federation wallet. The incident therefore raises questions that go beyond the size of the withdrawal: it challenges whether the controls around approvals and whitelisting performed as intended, or whether there is an unexpected pathway in the way approvals are generated and executed.

Crypto analyst DBCrypto argued that the behavior appears more consistent with an extraction that leaves funds “sitting on Bitcoin” rather than being rapidly mixed, describing it as potentially closer to “whitehat extraction than theft.” At the same time, DBCrypto said the broader security implications remain serious: either the required signatures and authorization logic were effectively satisfied, or the whitelist/control mechanisms designed to block such events did not hold.

SideSwap role and Liquid’s assertion about key security

Liquid said the withdrawn funds were sent via Sideswap, specifically through the SideSwap PAK (Peg-out Authorization Key). In Liquid’s statement, the PAK used in the transaction was not compromised, and it claimed that no other related keys were compromised either.

Liquid also reported that it had already established how the LBTC involved in the order was created—through a bug in Elements software. While the incident details in the public account focus on the peg-out authorization process and the status of the key, the Elements reference matters because it suggests the failure may have started earlier than the final Bitcoin withdrawal itself.

For market participants, the key implication is practical: if an Elements-level bug can affect how LBTC is created or approved for peg-out, then the operational risk isn’t confined to a single malicious transaction. Instead, it may require a broader review of how sidechain issuance and peg-out eligibility interact, and how those conditions are validated before bridge processing is allowed to resume.

What to watch as Liquid and related operators investigate

Liquid and its ecosystem appear to be working through a familiar incident sequence: identify which steps deviated from expected behavior, confirm whether any authorization keys were actually compromised, and determine what fixes or compensating controls are necessary before restarting bridge functions.

At the time of the provided coverage, Blockstream and Adam Back had not posted public updates on the incident timeline, but Samson Mow (Jan3 CEO) said “everyone is actively working to resolve this.” The immediate items for users and exchanges are likely straightforward—follow Liquid’s instructions to pause LBTC deposits and withdrawals until the bridge is re-enabled and the underlying security question is addressed.

Until Liquid publishes more technical detail on the peg-out authorization flow, the nature of the Elements bug, and why the multisig/whitelist protections were insufficient (or circumvented), the central uncertainty will remain the same: whether this was a one-off exploitation path or a systemic weakness that could reappear in other peg operations. Readers should watch for the moment bridge nodes return and for any concrete post-mortem describing exactly which authorization or validation step failed.

Documentary filmmaker Lance Oppenheim’s first fiction feature Primetime—premiering here at the Venice Film Festival—fills in some background pixels on the show’s rise and fall, focusing particularly on an ambitious, egotistical, and at least somewhat delusional Hansen, played by Robert Pattinson. It’s 2006, and Hansen and his beleaguered producer Andie (Merritt Wever, bringing an edgy nervousness to the role of a woman struggling to stay afloat in the ruthless world of TV news) get a chance to move their show into a primetime slot. The stakes are high, but the potential rewards are great. Hansen’s hubris balloons, and he infects others with his own inflated sense of the public service he claims to be providing. To complete its mission of reeling in the bad guys, the show employs youthful-looking decoys posing as underage kids. One of these is an elflike performer named Del (singer-songwriter Phoebe Bridgers) who can impersonate either a boy or a girl; she passes some tips along to a nervous newcomer who will come to be known as Decoy Dan (Skyler Gisondo, in a performance laced with touching eagerness). Though he hopes to become a real actor and thinks this is his way in, he wants to quit when he sees how demeaning the gig actually is. But Hansen, with his crocodile smile and purring, almost sultry intonation, persuades him to stick with it, assuring him that he’ll be helping to cleanse the world of evil.

Liquidated: ‘All your Bitcoin are belong to us’

A shade under 4000 Bitcoin worth $319 million has been taken from Liquid Network — with purported “white hat” hackers claiming responsibility. An unverified OP_RETURN message read: “we are whitehats. contact us on chain.”  

The Blockstream-run Bitcoin sidechain has been paused as the team attempts to identify the security hole and negotiate the return of funds. The Liquid explorer shows the balance of its federation wallet dropped from 4,200 BTC down to just 207.275 BTC, with 3,998.5 Bitcoin withdrawn.

Under normal Liquid mechanics, LBTC is burned on the sidechain before Bitcoin is withdrawn. The transaction needs to be authorized by an 11 of 15 multisig, and funds are sent to an approved whitelist.    

Liquid Network posted earlier today that: “the funds were withdrawn via the SideSwap PAK (Peg-out Authorization Key), but that key was not compromised, nor were any others.” 

“Bridge nodes have been temporarily disabled, so no new transactions can be submitted to the network. Effectively, the Liquid sidechain is paused until this issue is resolved.”

Crypto analyst DBCrypto noted that: “the coins aren’t running and they’re just sitting on Bitcoin and haven’t been mixed. That’s more consistent with a whitehat extraction than a theft.” But he said the incident raised some big questions about security on the sidechain. “Either 11 of 15 functionaries signed this off, or the whitelist built to prevent exactly this didn’t hold. Neither answer makes Liquid look good.”

So far Blockstream and Adam Back have not posted about the incident on X.  This is a developing story.

Source: Liquid Network

Bitcoin ETF inflows hit $3.8B in strongest three-week stretch of 2026

While Bitcoin is yet to hold above the 50-week moving average that would confirm a bull market, there are other signs bull market conditions are returning. The US spot Bitcoin ETFS have just recorded their strongest three-week inflow stretch of 2026 as Bitcoin trades just above $80,000.

The funds attracted $986.9 million in the week ending Friday, bringing net inflows over the past three weeks to $3.8 billion, according to SoSoValue data.

Total net assets across the funds stood at $101.3 billion on Friday, while cumulative net inflows reached $55.6 billion. On Thursday the Bitcoin ETFs recorded $730.9 million in net inflows, for the strongest showing since Jan. 14.

AMC boss cracks it over Robinhood’s tokenized stocks

Robinhood has been a stunning success so far, leading chains for daily fees and flipping Solana’s 24 hour DEX volume. It’s token launchpad PONS even broke into the Top 100 coins this week with a stunning 140% gain. Part of the interest has been in the Ethereum L2’s pairing of memecoins with tokenized stocks like AMC.

But while crypto degens love it, AMC’s CEO Adam Aron is less than impressed and has threatened to send in the lawyers over the chain’s “outrageous” decision to tokenize AMC stock without his express permission. He wrote on X:

“I find this practice to be contemptible, outrageous, disgusting, detestable, inexcusable, vile. How can it possibly be legal? We have no connection to this at all, and do not condone it in any way. “

Robinhood co-founder Vlad Tenev trolled him by asking blithely: “What’s the concern?” which sent Aron off on another rant about Robinhood’s “shocking and shameful” conduct. He called on them to “CEASE AND DECIST (sic)” and said the SEC could not possibly support Robinhood’s “sham ignoring of US securities laws. You can be sure we will be asking them.”

Robinhood’s chief legal officer Dan Gallagher — a former SEC commissioner — wrote back:

“We know a little something about the U.S. securities laws and will not “DECIST.” Send your lawyers and we’ll educate them.”

What a savage.

Source: Dan Gallagher

BofA, Citi, Goldman Sachs among 21 institutions planning stablecoin launch

A group of 21 major financial institutions plans to establish a new company to develop and issue stablecoins.

The consortium, announced Tuesday, includes Bank of America, Goldman Sachs, Citi, Deutsche Bank, UBS, Santander, MUFG and Fidelity Investments. It plans to launch a US dollar-denominated stablecoin in the first half of 2027, subject to the company’s formation and other conditions.

According to the announcement, the group ultimately plans to expand into stablecoins denominated in other G7 currencies, with a euro offering identified as its next priority.

In other news that crypto is playing with the big boys now, the G20 member nations put out a joint statement supporting crypto as a transformative way to bring about “broad-based economic growth.” It committed member nations to “advancing responsible and effective regulatory and supervisory frameworks that preserve financial stability, support economic growth, and establish clear pathways for sound digital financial and digital assets innovation.”

Kalshi bans Santos for life as New Jersey attempts to ban Kalshi for life

Prediction market platform Kalshi has banned ousted Republican lawmaker George Santos for life for allegedly using insider information for trading on event contracts. It’s one of the first lifetime bans the company has imposed since its launch in 2021. Kalshi said that Santos had been betting on markets involving his own actions, and stated he had “engaged in trading activity in certain markets related to his attendance at the State of the Union address” in February 2026.

In response to the ban, Santos called Kalshi an “unserious company.” 

Meanwhile New Jersey’s Attorney General officially petitioned the US Supreme Court to hear a case aimed at resolving whether state authorities or federal agencies have jurisdiction over prediction market companies. Officials cited civil cases brought by gaming authorities in “at least 20 states” that required the court to decide if state laws or the Commodity Futures Trading Commission’s rules took precedence.

“These companies have no right to offer their sports bets without following state law, which is why dozens of States across the ideological spectrum have opposed them […] We’re calling on the Supreme Court to resolve this issue and recognize that Congress did not silently make the sports-betting industry immune from state law.”

Winners and Losers

At the end of the week, Bitcoin (BTC) is up 2.6% to trade at $80,234, Ethereum (ETH) is up 2.3% to trade at $2,513 and XRP (XRP) is up 3% to $1.42. The total market cap is at $2.72 trillion according to CoinMarketCap.

Among the biggest 100 cryptocurrencies, the top three altcoin winners of the week are Pons (PONS) with a 140% gain, Arbitrum (ARB) on 116%, and Dash (DASH) on 66%.

The top three altcoin losers of the week are Pump.fun (PUMP) which was down 13.2%, Canton (CC) down 6.9% and Official Trump (TRUMP) down 4.1%.

Top Prediction of the Week

BTC will hit $1M by 2030… but Arthur Hayes is buying ETH instead

BitMEX founder Arthur Hayes told Cointelegraph the collapse of the AI bubble, “massive” money printing, and potential US yield curve control are among some of the reasons why Bitcoin could go to $1 million by 2030. “We have the ingredients. The time is now. So I think the $58,000 was probably the bottom in Bitcoin, and now it’s going to grind higher in this hate fuck rally,” the 41-year-old billionaire said.

But he added the best risk reward adjusted bet in crypto right now wasn’t Hyperliquid, but ETH and he’s been amassing a sizeable position. “That doesn’t necessarily mean that Hyperliquid won’t rise in price. I just don’t think it’s poised for a 5x, and like where I think Ethereum could do, you know, 3x to 5x pretty quickly,” he said.

Top FUD of the Week

El Salvador’s post-review Bitcoin accumulation used no public funds: IMF

El Salvador used no public resources to accumulate Bitcoin after the first review of its International Monetary Fund (IMF) financing program in June 2025, according to reports this week.

The IMF reportedly said documents supplied by Salvadoran authorities verified that the accumulation came from private donations. That would mean the increase in El Salvador’s holdings did not reflect additional Bitcoin purchases financed with government resources. 

The IMF also said majority ownership and operational control of the Chivo wallet had been transferred to a private operator, while the government retained a minority stake and custodial responsibilities.

But President Nayib Bukele called the story “fake news” and said the claim that El Salvador had transferred its Bitcoin returns to a private party was “TOTALLY FALSE.” He pointed to this IMF link as evidence:

“Read it. It clearly says the opposite: that the only thing that was transferred were Chivo shares, something that was offered a year and a half ago, and NOT the Bitcoin Strategic Reserve.”

Fake Claude desktop app spreads crypto-stealing malware

A fake Claude desktop application is reportedly being used to distribute RevStealer, a Windows malware strain built to steal crypto, password and browser data.

According to a Monday report by cybersecurity company Morphisec, RevStealer was previously distributed through GitHub repositories and game-cheat-themed sites but the most notable is a fake “Claude Opus 5 Free Desktop” project that impersonates AI developer Anthropic and promises free access to Claude.

The researchers noted that the malware is designed to leave few traces and searches browser databases, cookies, password-manager records, VPN and remote-access settings, messaging data, screenshots and selected documents. RevStealer also targets over 50 cryptocurrency wallets.

Hyperscale Data ends Michigan BTC mining as holdings fall 79%

Hyperscale Data has ended all Bitcoin mining operations at its Michigan facility as it prepares the site for an artificial intelligence data center customer. 

On Wednesday, the company said that all Bitcoin miners at the facility were switched off and that it intends to sell the associated mining equipment. 

Hyperscale said the AI customer has contracted for 20 megawatts (MW) of computing capacity under a 10-year master services agreement with two optional five-year extensions. The agreement may generate more than $1.2 billion over the maximum 20-year term. An additional 32 MW option could lift potential revenue above $3 billion, while the site is expected to support 340 MW. 

Hyperscale has also reduced its Bitcoin holdings sharply while funding the AI buildout. It’s holdings have dropped from 1006 Bitcoin at the end of July to around 215 BTC today.

Top Magazine Stories of the Week

The million dollar question is what prompted a Bitcoin OG to send 20 BTC to a custodian, retrieve it back, and then deliberately burn it?

Advertisement

Crypto is showing signs of life again, but its biggest wins look different from what early believers imagined. After a decade of building, has it all been worth it?

Crypto projects are spending hundreds of millions buying their own tokens. But are buybacks creating lasting value — or just making tokens look more valuable than they really are?

Crypto recovery specialists reveal how lost wallets, passwords and seed phrases can sometimes be recovered — but that’s of no help if the money was never there in the first place.

XRP climbed roughly 6% in a single trading session, pushing its price back above $1.45. The move followed dovish comments from Federal Reserve officials, and it lifted the broader crypto market with it. Traders now point to $10 as a long-term target for XRP, a figure that seemed unrealistic only weeks ago.

The rally stems from shifting expectations around Fed interest rate policy. Risk assets across markets caught a bid as traders priced in a friendlier rate path ahead. XRP’s 24-hour trading volume held near $4 billion, and its market cap settled around $90.9 billion.

That volume places XRP firmly among the largest cryptocurrencies by market presence. Rate-cut speculation has shifted throughout the week, and that uncertainty spilled directly into XRP price action. An August surge took XRP from $1 to $1.70, a 70% jump, and set the stage for the current rebound.

XRP Faces Key Resistance After Its August Correction

XRP corrected 20% after that August peak, sliding into a $1.35–$1.38 range. That zone has since become the support level bulls are defending. XRP now trades near $1.45, sitting comfortably above that band.

The 200-day exponential moving average sits close behind, between $1.33 and $1.35. That level offers bulls a cushion if selling pressure returns. Trading volume near $5.5 billion suggests real participation rather than a thin, short-lived spike.

Chart patterns still show a descending triangle stretching back to August’s $1.70 high. XRP is bouncing off triangle support, but it hasn’t broken through resistance yet. A hold above $1.34 would set up a retest of the $1.55 level next.

A clean break past resistance could open a path toward $1.60 to $1.90. Alternatively, XRP could consolidate between $1.38 and $1.52 while markets digest new data. A drop below $1.30 would risk a deeper pullback, especially around upcoming jobs figures.

Speculation about a potential XRP ETF continues to feed talk of a $10 price target. That timeline, however, remains unconfirmed and speculative for now. Institutional demand has reportedly grown beneath the surface, adding some support to bullish arguments.

Bitcoin Hyper Presale Draws Attention as XRP Holds Its Range

A 6% to 7% bounce benefits current XRP holders, but scaling further presents a steeper challenge. XRP’s $90 billion market cap means doubling in value requires substantial new capital. That kind of move typically unfolds over months, not days or weeks.

Smaller, early-stage tokens face a different math problem entirely. Bitcoin Hyper (HYPER) has emerged as one project drawing interest in that category. It positions itself as a Bitcoin Layer 2 network with full SVM integration built in.

The project aims for execution speeds faster than Solana while settling transactions back to Bitcoin’s base layer. Its presale has raised $33.1 million so far, with tokens priced at $0.0136857 each. Staking rewards during the presale period are advertised at over 60% annual percentage yield.

The project also highlights a decentralized bridge for moving Bitcoin across networks. Low-latency Layer 2 processing is designed to address Bitcoin’s limited programmability. As with any presale-stage project, these figures come from the project’s own promotional materials and remain unverified by independent audits.