ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “federation wallet”

494 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllRansomware 154Malware 76Phishing & fraud 75Policy & legal 43Exploit / PoC 42Data breach 41Vulnerability 30Threat actor 24Industry 6AI safety & security 2AI tools & infra 1
SeverityAllcritical 214high 161medium 60low 53info 6

Hackers have withdrawn ~4k BTC (~$320M) from the Liquid Federation wallet

Hackers reportedly withdrew about 4,000 BTC (~$320 million) from the Liquid Federation wallet, according to a widely shared report on X.

A post on X reports that hackers withdrew roughly 4,000 BTC — valued near $320 million — from the Liquid Federation wallet. The source text provides no details on the compromise method, attribution, custody impact, or any organizational response. The story drew heavy attention on Hacker News (125 points, 86 comments), indicating broad community concern.

Hacker News · security · 9d agoData breach in the wildHN 125↑ · 86 comments

Hackers drain $320M in Bitcoin from Liquid Network, claim they're the good guys

Attackers withdrew about 4,000 BTC (~$320M) from Liquid Network's federation wallet via a SideSwap peg-out, claiming whitehat status.

Hackers drained roughly $320 million in Bitcoin — about 4,000 BTC, 95% of holdings — from the federation wallet backing Blockstream's Liquid Network sidechain. The withdrawal occurred through SideSwap using its Peg-out Authorization Key (PAK), yet no PAK appears to have been compromised, and the exact mechanism remains under investigation. The actors embedded an on-chain message identifying themselves as whitehats, asked Blockstream to patch federation nodes first, and promised to return most of the funds after fixes are confirmed. Liquid disabled its bridge nodes and asked exchanges to suspend L-BTC deposits and withdrawals; other Liquid assets and the Bitcoin network were unaffected.

The Register · Security · 8d agoExploit / PoC in the wild

Hackers Drain $320 Million From Liquid Network, Then Return Most of It

Hackers exploited an Elements bug to drain about 4,000 BTC (~$320M) from Liquid Network's federation wallet, then returned 3,400 BTC after Blockstream patched.

An attacker drained roughly 4,000 of 4,200 BTC (~$320M) from Bitcoin's Liquid Network federation wallet on September 6 by exploiting a bug in Elements, the open-source code powering the sidechain, which allowed unbacked L-BTC tokens that were redeemed for real Bitcoin through SideSwap's authorized peg-out mechanism. The self-described white-hat attackers negotiated publicly via OP_RETURN on-chain messages, demanding the bridge nodes be patched before returning 3,400 BTC (~$262.6M) and keeping about 598 BTC (~$47M). Blockstream confirmed the affected bridge nodes were patched; the network remains paused while federation members complete security work, and experts debate whether the act legally constitutes extortion.

Security Affairs · 7d agoExploit / PoC in the wild

Hackers Return $263 Million Stolen From Liquid Network

Hackers drain roughly 4,000 BTC (~$320M) from Liquid Network federation wallet, then return 3,400 BTC with ~598 BTC still outstanding.

Attackers withdrew about 4,000 Bitcoin (roughly $320 million) from the Liquid Network federation wallet, which held approximately 4,200 BTC, via the SideSwap Peg-out Authorization Key without that key being compromised. Blockstream disabled nodes and suspended transactions after disclosing the heist on Sunday. Alleged white-hat hackers returned 3,400 BTC (~$262.6M) on Monday, demanding the underlying bug be patched before releasing the remaining ~598 BTC (~$47M). The network remains paused while fixes and a safe restart are prepared.

SecurityWeek · 7d agoData breach in the wild

Hackers drain $320M in Bitcoin from Liquid Network, claim they’re the good guys

Hackers withdrew roughly 4,000 BTC (about $320M) from the Liquid Network federation wallet backing the Blockstream-developed Bitcoin sidechain, claiming benign intent.

Blockstream said Sunday that around 4,000 BTC, roughly $320 million, was withdrawn from the federation wallet backing Liquid Network, a Bitcoin sidechain used by exchanges and financial institutions. The attackers publicly claimed they were 'the good guys'; no attribution or recovery details are provided. The theft affects infrastructure that backs custodial Bitcoin transfers for exchanges.

DataBreaches.net · 8d agoData breach in the wild

Liquid Hackers Return 3,400 Bitcoin Taken via Elements Bug, Still Holding $47M in BTC

Hackers exploited an Elements bug to take ~4,000 BTC from Liquid Network, returned 3,400 BTC (~$265M), and still hold ~598.5 BTC (~$47M).

Attackers exploited a bug in Elements, the software behind Blockstream's Liquid Network Bitcoin sidechain, to create L-BTC and withdraw roughly 4,000 BTC (about $320 million) via SideSwap's Peg-out Authorization Key, roughly 95% of Liquid's reported reserves. They returned 3,400 BTC (about $265 million at ~$78,000 per BTC) to the federation address on September 7, keeping about 598.5 BTC (roughly $47 million). The group called itself white hats, demanded node patches before returning funds, and negotiated via on-chain and PGP-encrypted messages; Ledger CTO Charles Guillemet characterized the arrangement as extortion. Blockstream says the peg-out key and other keys were not compromised, updated software is deployed, and the network remains paused pending a coordinated restart.

The Hacker News · 7d agoExploit / PoC in the wild

$245 million in stolen crypto funded racketeering crew’s lavish lifestyle

Malone Lam pleaded guilty in D.C. federal court to a racketeering conspiracy that stole and laundered over $245 million in cryptocurrency via social engineering.

Malone Lam, a 22-year-old Singapore citizen, pleaded guilty in Washington D.C. federal court to running a racketeering conspiracy that stole and laundered more than $245 million in cryptocurrency. The operation ran from at least October 2023 through May 2025, grew out of online gaming platforms, and relied on social engineering to trick victims into surrendering wallet access, sometimes including break-ins to victims' homes. Lam was arrested on September 18, 2025 in Miami; prosecutors said members spent lavishly on nightclubs, private jets, and exotic cars priced from $100,000 to $3.8 million.

Help Net Security · 6d agoPhishing & fraud

Week in review: Linux rootkit deployed on F5 BIG-IP APM devices, Cisco FMC bugs exploited

Weekly roundup: Cisco FMC and N-able N-central zero-days exploited in the wild, MikroTik RouterOS hijacks, Microsoft Patch Tuesday ships two exploited zero-days.

State-sponsored and financially-motivated attackers are actively exploiting CVE-2026-20079, a critical authentication bypass in Cisco Secure Firewall Management Center (FMC), alongside CVE-2026-20316. N-able issued an emergency hotfix for CVE-2026-86218, a critical pre-auth RCE in the N-central RMM platform exploited in the wild. CERT Polska disclosed six RouterOS vulnerabilities being chained to hijack internet-exposed MikroTik devices. Microsoft's September 2026 Patch Tuesday shipped a record patch count including two zero-days, while roughly 67,000 Trezor customers faced phishing after a shipping-partner breach and researchers privately disclosed a zero-click WeChat worm to Tencent.

Help Net Security · 2d agoExploit / PoC in the wildCVE-2026-20079CVE-2026-20316CVE-2026-862182· 1 read