Liquid is investigating a potential exploit in its confidential transactions that may have let attackers inflate LBTC balances and redeem nearly 4,000 LBTC for BTC. The pegout was signed by federation HSMs without key compromise, suggesting an amount validation flaw. Liquid operations are effectively paused while members investigate, with USDT, DePix, and RWA assets reported unaffected.

ChainCatcher said a Bitcoin wallet created in 2016 transferred 1,260.77 BTC at block height 965,770, with the funds sent to an unidentified P2WPKH address. The wallet was opened on July 9, 2016, when its balance was valued at about $819,500. At current prices, the holdings are worth more than $100 million. Separately, close to 75 Casascius physical bitcoins were "redeemed" during the first six days of September. On Sept. 3, 14 first-series Casascius coins were redeemed. About 15 more followed on Sept. 4, and Sept. 5 saw a single-day total of 40. Casascius physical bitcoins were produced by Mike Caldwell between 2011 and 2013. The coins, made from brass, silver and gold-plated materials, contain BTC stored via an embedded private key. "Stripping" or "redeeming" refers to peeling back the hologram seal to reveal the private key and move the associated bitcoin.

An apparent exploit involving roughly 4,000 BTC on Blockstream's Liquid Network has surfaced just weeks after the company introduced Blockstream Swaps, an in-house service designed to move Bitcoin between the mainchain, Liquid and Lightning. Blockstream accelerated the rollout after Boltz disabled swaps in August, pointing to a surge in automated, AI-assisted attacks and multiple exploits targeting its infrastructure. Two days ago, Blockstream said testing was "going well" and expanded beta access to more users. Blockstream is now responding on-chain to alleged "whitehats" after what appears to be the largest incident involving the Liquid Network to date.

Ledger CTO Charles Guillemet said roughly 4,000 BTC have been pegged out of the Liquid bridge, accompanied by an OP_RETURN message reading, "we are whitehats. contact us on chain." Guillemet questioned the "whitehat" claim, arguing that genuine security researchers do not drain a bridge and then ask to be contacted onchain. He said the episode recalls the Ronin hack, where attackers obtained validator keys and stole about $625 million. He also noted that the "let's talk" tone resembles the Euler exploit aftermath, when the attacker entered negotiations to return funds. Blockstream has replied onchain, requesting the party reach out to its security team.

Liquid Network's dashboard has confirmed an unauthorized withdrawal of roughly 4,000 BTC. According to @btcinsider__, attackers appear to have deceived Liquid's functionaries into approving a transaction that looked legitimate to internal systems, but effectively authorized a peg-out of about 3,998 BTC to the Bitcoin network. The transaction reportedly cleared Liquid's validation checks, prompting the functionaries' security hardware to sign the withdrawal. The attackers say they are white hats.

Roughly 4,000 BTC was moved off Blockstream's Liquid Network in a single pegout, with an onchain OP_RETURN note framing the action as a "white hat" operation and inviting contact: "We're the good guys. Let's talk." About 4,200 BTC tied to the transaction is valued near $320 million at a Bitcoin price around $80,000. Neither Liquid Network nor Blockstream has issued a statement, leaving it unclear whether this was a security breach, an insider-authorized withdrawal, or another coordinated action. What happened On September 6, a Liquid Network pegout sent approximately 4,200 BTC back to the Bitcoin mainchain. Observers noted that around 4,000 BTC moved in parallel, suggesting coordination. The transaction included an OP_RETURN field identifying the actors as "white hats" and proposing further communication onchain. Liquid typically processes pegouts in batches that take about 11 to 35 minutes. The scale of the transfer completing without any visible disruption is raising questions about how the required approvals were obtained. How Liquid's security model is designed Liquid is a Bitcoin sidechain developed by Blockstream and governed by a "Strong Federation", a group of known entities responsible for managing the Bitcoin reserves that back LBTC on the sidechain. The system uses an 11-of-15 multisig setup, meaning at least 11 of 15 designated functionaries must authorize movements of the underlying Bitcoin. Pegouts also require Pegout Authorization Keys (PAKs), an additional safeguard intended to reduce the impact of compromised functionaries. A ~4,200 BTC pegout implies either the layered controls were bypassed or the transaction was executed through valid authorization paths. Without an official explanation, both scenarios are unsettling. The "white hat" angle Onchain self-identification as a "white hat" is a known tactic, particularly in DeFi, where attackers sometimes negotiate the return of funds while keeping a portion as a "bounty". The Euler Finance exploit in 2023 and the Poly Network incident in 2021 followed similar patterns. The key unknown is Blockstream's posture. So far, the company has not confirmed unauthorized access, denied an exploit, or acknowledged the transaction. Implications for federated sidechains Federated sidechains such as Liquid sit between Bitcoin's trust-minimized base layer and fully centralized custodial systems. Users typically accept trust in a set of validators in exchange for faster transfers and added functionality. If 11 of 15 functionaries can be compromised, or if the PAK mechanism can be circumvented, the assumptions behind Liquid's security model may need reevaluation. For Liquid users relying on the network for faster settlement, confidential transactions, or Liquid-native assets, the near-term question is straightforward: are the remaining reserves secure? In the absence of transparency from Blockstream, that question remains unanswered.

Blockstream issued an on-chain response after a group describing itself as "white hats" said it wanted to establish contact following the exploitation of 4,000 BTC from the Liquid Network. In its message, Blockstream asked the parties involved to reach out via email: "Please contact security@blockstream.com". This story is developing.

U.S. bond markets are heading into a potentially volatile stretch as investors juggle shifting Federal Reserve expectations, heavy Treasury issuance and a packed economic calendar that could drive large moves across the yield curve, from the front end to the 30-year. The long bond has become a focal point. The 30-year Treasury yield has held above 5% for 55 days so far in 2026, marking its longest run at those levels since 2006. As of early September 2026, the 10-year yield is around 4.78% and the 2-year near 4.37%. The 30-year sits at roughly 5.24%. The 2s10s spread is about 41 basis points, while the 3-month to 10-year spread is wider at 87 basis points. A major driver of the turbulence is the Fed's leadership shift under Chair Kevin Warsh, who took over in late May 2026. Warsh has moved the central bank toward a more strictly data-dependent approach and provided less forward guidance than markets had grown used to, pushing implied volatility higher in short-dated rate options. Warsh added to the uncertainty on Aug. 28, when comments from the chair rattled markets and revived the possibility of a rate hike at the September FOMC meeting. The 10-year yield briefly moved above 4.8%, and pricing in rate markets lifted hike odds to roughly 50% or more. Next week's labor-market reports are pivotal. Strong jobs data could tilt expectations toward a September hike, while weaker readings could remove it from the conversation. Supply dynamics are also intensifying. Corporate debt issuance reached $1.68 trillion through August 2026, up 27% from the same period a year earlier. A significant portion is linked to AI-related capital spending as companies build data centers, buy chips and fund the infrastructure needed to compete. That wave of corporate issuance is layering on top of heavy Treasury supply as the U.S. government continues to finance large fiscal deficits. At times, the market has seen bear-flattening moves, with long-end yields rising but short-end yields climbing faster. The curve has also periodically steepened, depending on which data release or Fed signal is dominating trading. The coming weeks carry added stakes because several catalysts are landing in a tight window: the September FOMC meeting, key labor data and a busy corporate issuance calendar.

China's Ministry of Finance has injected $54 billion into state-owned banks and insurers. The funding includes 360 billion yuan allocated to insurers. Agricultural Bank of China (ABC) and Industrial and Commercial Bank of China (ICBC) together received 290 billion yuan.