FORENSIAWeb3 forensicsOpen workspace
Case file 06

Liquid Network: Unbacked L-BTC and Reserve Drain

About four thousand bitcoin left a sidechain's reserve and no key was stolen. Four hours later a note appeared in a transaction: we are whitehats. 3,400 bitcoin came back. 598 did not, and it is still sitting at the same address.

Date
September 6, 2026
Network
Bitcoin
Reported amount
≈4,000 BTCpaid out of the Liquid Federation's reserve
What happened
Unbacked sidechain coins redeemed through the normal withdrawal route
Status
598.5 BTC not returned
This file rests on
7 recorded and 11 reported statementsacross 4 linked identifiers
11 chapters · choose one to jump the film to it
The investigation, step by step

Replay it yourself.

These are the film’s own beats. Choose a time to jump the film there. Where a step rests on a record, open it in the workspace and read today’s capture of the same record.

  1. The note

    Four thousand bitcoin left a sidechain's reserve. No key was stolen. Four hours later a note was written into the blockchain: we are whitehats. 3,400 bitcoin came back. 598 did not.

  2. One: the flaw

    On September 6, on Liquid, a Bitcoin sidechain, a caching flaw lets about four thousand L-BTC be created with no bitcoin behind it. That is Liquid's own account.

    Reported by others
    • A range-proof verification caching flaw created roughly 4,000 unbacked L-BTC.Liquid's incident report
    • No federation signing key was compromised and the withdrawal mechanism operated as designed.Liquid's incident report

  3. Two: the payout

    The new coins are redeemed through the normal withdrawal route. At 14:28 UTC the federation pays out on Bitcoin.

    Reported by others
    • The payout, 3,996.01834922 BTC from the federation's wallet, is in block 965,783 at 14:28:56 UTC.Public Bitcoin explorer, checked for the film

  4. The forward

    Block 965,783. One input, two outputs. Almost 3,996 bitcoin lands on a new address, in the same block as the payout.

    Recorded · captured October 7, 2026
    • Bitcoin block 965,783. 1 input and 2 outputs.
    • 3,995.99999857 BTC to bc1ql4mf…gyqjlte.
    Reported by others
    • The forward is in the same block as the federation's payout.Public Bitcoin explorer, checked for the film
    Open this step in the workspace
    Opens a live lookup on the Activity view. Today’s capture may differ from the film’s.

  5. Three: the first note

    Four hours later that address sends its whole balance back to itself, with a note attached: we are whitehats. contact us on chain.

    Reported by others
    • The note, sent September 6 at 18:30 UTC, reads: we are whitehats. contact us on chain.Read from the transaction on a public explorer
    Open this step in the workspace
    Opens a live lookup on the Summary view. Today’s capture may differ from the film’s.

  6. Four: more notes

    More notes follow the same way. One asks whether sending most of it back is ok. The next says to fix the bug first.

    Reported by others
    • Notes on September 7 at 02:20 and 03:30 UTC. The rest of the second one is encrypted.Read from the transactions on a public explorer

  7. Five: the return

    September 7, 16:09 UTC. Fifteen inputs, two outputs. 3,400 bitcoin goes to the federation's wallet, and Forensia flags the other output as likely change: 598 bitcoin, back to the sender.

    Recorded · captured October 7, 2026
    • Bitcoin block 965,950. 15 inputs and 2 outputs.
    • One lead: output 0 is the likely change output, on 3 of 4 heuristics.
    • 598.49955894 BTC back to bc1ql4mf…gyqjlte.
    Reported by others
    • The other output pays 3,400 BTC to the federation's wallet.Public Bitcoin explorer, checked for the film
    Open this step in the workspace
    Opens a live lookup on the Summary view. Today’s capture may differ from the film’s.

  8. Six: the demand

    September 9. One more note. It demands ten percent as a bug bounty. Blockstream calls withholding the funds a crime and refuses to pay.

    Reported by others
    • A note on September 9 at 11:45 UTC demands 10% as a bug bounty.Read from the transaction on a public explorer
    • Taking assets without authorization and withholding their return is "a crime, not responsible disclosure". No ransom will be paid.Blockstream

  9. Seven: the address today

    598.5 bitcoin. Still there. Nothing sent since September 9.

    Recorded · captured October 7, 2026
    • A balance of 598.50465955 BTC.
    • 1,250 unspent outputs.
    Reported by others
    • The last spend from the address was on September 9 at 11:45 UTC.Public Bitcoin explorer, checked for the film
    Open this step in the workspace
    Opens a live lookup on the Summary view. Today’s capture may differ from the film’s.

  10. The noticeboard

    The address has become a noticeboard: more than fourteen hundred transactions from strangers, nearly all carrying a message.

    Reported by others
    • 1,442 incoming transactions from other senders, 1,432 of them carrying text.Public Bitcoin explorer, checked for the film

  11. Not known

    Who controls the address. Whether the rest comes back.

The number and the record

What the headline said. What a closer reading shows.

The headline said≈4,000

unbacked L-BTC created, with no signing key compromised

Liquid's incident report
On a closer reading598.50 BTC

still at the address that sent 3,400 back

Recorded in the lookup
The incident on one map

Who called what, and where it went.

Recorded in the workspaceReported by others

Redeemed3,996.02 BTCSame blockSep 7 · 15 inputs3,400 BTC back598.5 BTC changeLiquid sidechainNot read hereThe federation's walletbc1qdlld…suhwxxrThe withdrawal serviceReceives the payoutThe receiving addressbc1ql4mf…gyqjlteThe returna6d697…49a46d
Timeline

In the order it happened.

  1. About 4,000 unbacked L-BTC is created on Liquid through a caching flaw.Reported by others

  2. The federation pays out 3,996.02 BTC on Bitcoin.Reported by others

  3. 3,995.99999857 BTC is forwarded to a new address.Recorded

  4. The first note: we are whitehats. contact us on chain.Reported by others

  5. 3,400 BTC returns to the federation's wallet. 598.49955894 BTC goes back to the sender.Recorded

  6. A last note demands 10% as a bug bounty. Blockstream refuses.Reported by others

  7. The address holds 598.50465955 BTC.Recorded

The cast

Every address and transaction in this case.

Grouped by their place in the records. A group says what an address did here, not who controls it. Supported identifiers open as live lookups.

Open the investigation

Where it went

Addresses that received the value. Who controls them is not established here.

  • The receiving addressBitcoin address

    Received the forward, sent the notes, made the return. It held 598.5 bitcoin when captured.

    Investigate

The transactions

The individual records each step of the case rests on.

  • The forwardBitcoin transaction

    3,995.99999857 BTC to the receiving address, in the same block as the federation's payout.

    Investigate
  • The returnBitcoin transaction

    3,400 BTC to the federation's wallet. 598.49955894 BTC back to the sender.

    Investigate
  • The first noteBitcoin transaction

    The address sends its balance to itself with a text note attached. Forensia does not decode the text.

    Investigate
Recorded and reported

Two kinds of statement, kept apart.

Recorded statements were read in the workspace on October 7, 2026. Reported statements come from the source named beside each one and were not verified by Forensia. The flaw itself happened on Liquid, which Forensia does not read, so that part is reported. Forensia shows the note transactions and their amounts but does not decode the note text; the wording is read from the transactions on a public explorer.

What the chain records7

  • Step 4

    Bitcoin block 965,783. 1 input and 2 outputs.

  • Step 4

    3,995.99999857 BTC to bc1ql4mf…gyqjlte.

  • Step 7

    Bitcoin block 965,950. 15 inputs and 2 outputs.

  • Step 7

    One lead: output 0 is the likely change output, on 3 of 4 heuristics.

  • Step 7

    598.49955894 BTC back to bc1ql4mf…gyqjlte.

  • Step 9

    A balance of 598.50465955 BTC.

  • Step 9

    1,250 unspent outputs.

What others have reported11

  • Step 2

    A range-proof verification caching flaw created roughly 4,000 unbacked L-BTC.Liquid's incident report

  • Step 2

    No federation signing key was compromised and the withdrawal mechanism operated as designed.Liquid's incident report

  • Step 3

    The payout, 3,996.01834922 BTC from the federation's wallet, is in block 965,783 at 14:28:56 UTC.Public Bitcoin explorer, checked for the film

  • Step 4

    The forward is in the same block as the federation's payout.Public Bitcoin explorer, checked for the film

  • Step 5

    The note, sent September 6 at 18:30 UTC, reads: we are whitehats. contact us on chain.Read from the transaction on a public explorer

  • Step 6

    Notes on September 7 at 02:20 and 03:30 UTC. The rest of the second one is encrypted.Read from the transactions on a public explorer

  • Step 7

    The other output pays 3,400 BTC to the federation's wallet.Public Bitcoin explorer, checked for the film

  • Step 8

    A note on September 9 at 11:45 UTC demands 10% as a bug bounty.Read from the transaction on a public explorer

  • Step 8

    Taking assets without authorization and withholding their return is "a crime, not responsible disclosure". No ransom will be paid.Blockstream

  • Step 9

    The last spend from the address was on September 9 at 11:45 UTC.Public Bitcoin explorer, checked for the film

  • Step 10

    1,442 incoming transactions from other senders, 1,432 of them carrying text.Public Bitcoin explorer, checked for the film

Keep going

The ideas behind this case, and what to read next.

Docs · 2 minWhich output is the change

How Forensia guesses which output of a payment went back to the sender, why it needs agreement between rules, and when it stays silent.

Docs · 5 minBridges, mixers and exchanges

Three places a trail commonly stops, what each one does, and what can still be said afterwards.

Docs · 3 minCaptured, bounded, declined

The three grades of support behind a Forensia statement, how each view marks them, and how to read a result with them.

Case · Ethereum · BridgeSingularityNET: Bridge Drain and Token Mints

8.72M FET, drained from the SingularityNET bridge.

Case · Bitcoin · Key generationColdcard: Bitcoin Wallet Drains

≈1,816 BTC, in four waves, from more than 5,000 wallets.

Share and cite

Take the case with you.

The brief is one page: the steps, the timeline, every identifier, and which statements are recorded and which are reported.

FORENSIA

Web3 forensics that shows its sources. Read-only, public evidence, and a clear line where the proof ends.

Contact us

Leave your name and email and the Forensia team will write back.

How we handle your emailOr email us directly

By selecting Contact me you agree that Forensia may email you at this address about your enquiry. You can withdraw anytime. Name, email and consent are kept for up to 90 days, separately from investigations. No searched address is included in this submission.