On 6th September, 2026, Blockstream-designed Bitcoin sidechain Liquid Network was hit by a major hack when hackers withdrew 4,000 bitcoin amounting to $320 million from the federation wallet backing L-BTC, the network token.
While the network confirmed that the withdrawal was made using a legitimate but uncompromised authorisation key, the actual vulnerability was in the open-source software underpinning the network, Elements. However, the interesting bit here is that the collective that siphoned the money left an on-chain message claiming that they were “white hats.”
They reportedly told Blockstream that they’d return a majority of the money, but only once the vulnerability was patched across every node, and only after handing over the technical details required to do it. Cut to 3-4 days later: Liquid Network got back only 3,400 bitcoin from the hack, with close to $47 million worth of bitcoin still nowhere to be seen.
Now, the story sounds tidy on the surface: hackers finding a hole, exploiting it to prove its existence, and then behaving responsibly by returning “most” of the money – a sort of “fee” for doing the right thing. But if we were to look at the actual mechanics, the fact is that it’s a sort of ransom, isn’t it?
White Hats vs Black Hats: But Are They Really White Hats?
Broadly speaking, there are two main types of hackers, white hat hackers and black hat ones. Drawing inspiration from old Spaghetti Westerns where the good guys wore white hats and the bad guys wore black hats, black hat hackers have malicious (and monetary) intents, while white-hat hackers are the ethical ones with no intention of doing any harm to the system. Usually, white hats are found helping organisations with their cybersecurity, providing security solutions and helping them locate vulnerabilities.
However, in today’s day and time, the white hat label doesn’t match the supposed behaviour – and therein lies the rub. Genuine white hats and security researchers routinely prove the existence of exploitable vulnerabilities by moving a few dollars here and there through flawed systems. That’s enough to demonstrate that the vulnerability is real without having to touch anything that isn’t theirs. Liquid’s so-called white hat hackers siphoned off 95% of the wallet’s reserves.
In fact, this isn’t even the first time that this pattern has shown up in the cryptocurrency world. In 2021, Poly Network lost a whopping $600 million to a hacker who eventually returned almost all of the stolen amount after days of on-chain messages, public negotiation, and even an offer of a “bug bounty” from the protocol itself at one point.
Similarly, Euler Finance saw nearly $197 million disappear in a flash-loan attack in front of their eyes in 2023, with the hacker returning the funds in stages, with each payment apparently tied down to progress on immunity from prosecution.
Lately, the so-called white-hat hack script is the same: take everything that isn’t nailed down, assert good intent, and then set terms for giving it back. However, proving that a bug or a vulnerability exists doesn’t require draining wallets or reserves; all one usually requires to file a report and collect a bounty is a $5 proof-of-concept.
Everything beyond that isn’t a technical necessity – it’s a choice.
What The White Hats Are Actually Doing Here
When you do away with all the technical terms and language, what’s left, especially in the Liquid Network case, is a hostage negotiation with a patch deadline attached. The hackers weren’t simply waiting for public pressure to build before returning funds, which is about how the Poly Network situation played out.
Now they’re setting conditions: fix the software on their terms, using the details they’re prepared to supply, and only then will most of the money they stole reappear. That’s a materially different threat than simply asking for a bounty – it’s the fact that they control the timeline for the organisation’s own security fix, as well as how the ransom should be paid. Calling this “white hat hacking” is basically reframing draining a wallet and calling it a public service.
It sidesteps the language of ransom, extortion, or theft, all of which carry legal consequences that responsible disclosure doesn’t. Furthermore, it borrows credibility from an entire profession of legitimate security researchers who have spent years building the norm that reporting flaws and vulnerabilities shouldn’t require taking anything at all.
And that borrowed credibility is the real cost here. Every time a hack or an exploit sees the movement of nine-figure sums in the guise of ethical hacking, it becomes harder for legitimate researchers to report genuine vulnerabilities without being asked the question of why they didn’t just take money as well. It’s this reason why bug bounty programmes exist in the first place.
When white hat behaviour involves emptying reserve wallets first and then negotiating, it all becomes about leverage, rather than ethics.
What Do We Call This?
What’s interesting is not whether the Liquid Network attackers will return the rest of the funds. The more useful question is what happens to the term “white hat hacking” if this itself becomes the default script for handling such discovered exploits: steal first, prove intent later, and then negotiate the timing and the size of the return.
With federated systems such as Liquid being pitched as trustworthy alternatives to pure trustless blockchain models, incidents like these undercut that pitch too. “White hat” described intent before the fact, but what’s emerging instead is a version that’s applied retroactively.
Whether regulators, exchanges, and the security research community push back on that redefinition will decide whether the phrase still means something the next time a few hundred million goes missing.
In case you missed:
Click Here For The Original Source.
