ChainCatcher said a Bitcoin wallet created in 2016 transferred 1,260.77 BTC at block height 965,770, with the funds sent to an unidentified P2WPKH address. The wallet was opened on July 9, 2016, when its balance was valued at about $819,500. At current prices, the holdings are worth more than $100 million. Separately, close to 75 Casascius physical bitcoins were "redeemed" during the first six days of September. On Sept. 3, 14 first-series Casascius coins were redeemed. About 15 more followed on Sept. 4, and Sept. 5 saw a single-day total of 40. Casascius physical bitcoins were produced by Mike Caldwell between 2011 and 2013. The coins, made from brass, silver and gold-plated materials, contain BTC stored via an embedded private key. "Stripping" or "redeeming" refers to peeling back the hologram seal to reveal the private key and move the associated bitcoin.

Ledger CTO Charles Guillemet said roughly 4,000 BTC have been pegged out of the Liquid bridge, accompanied by an OP_RETURN message reading, "we are whitehats. contact us on chain." Guillemet questioned the "whitehat" claim, arguing that genuine security researchers do not drain a bridge and then ask to be contacted onchain. He said the episode recalls the Ronin hack, where attackers obtained validator keys and stole about $625 million. He also noted that the "let's talk" tone resembles the Euler exploit aftermath, when the attacker entered negotiations to return funds. Blockstream has replied onchain, requesting the party reach out to its security team.

Roughly 4,000 BTC was moved off Blockstream's Liquid Network in a single pegout, with an onchain OP_RETURN note framing the action as a "white hat" operation and inviting contact: "We're the good guys. Let's talk." About 4,200 BTC tied to the transaction is valued near $320 million at a Bitcoin price around $80,000. Neither Liquid Network nor Blockstream has issued a statement, leaving it unclear whether this was a security breach, an insider-authorized withdrawal, or another coordinated action. What happened On September 6, a Liquid Network pegout sent approximately 4,200 BTC back to the Bitcoin mainchain. Observers noted that around 4,000 BTC moved in parallel, suggesting coordination. The transaction included an OP_RETURN field identifying the actors as "white hats" and proposing further communication onchain. Liquid typically processes pegouts in batches that take about 11 to 35 minutes. The scale of the transfer completing without any visible disruption is raising questions about how the required approvals were obtained. How Liquid's security model is designed Liquid is a Bitcoin sidechain developed by Blockstream and governed by a "Strong Federation", a group of known entities responsible for managing the Bitcoin reserves that back LBTC on the sidechain. The system uses an 11-of-15 multisig setup, meaning at least 11 of 15 designated functionaries must authorize movements of the underlying Bitcoin. Pegouts also require Pegout Authorization Keys (PAKs), an additional safeguard intended to reduce the impact of compromised functionaries. A ~4,200 BTC pegout implies either the layered controls were bypassed or the transaction was executed through valid authorization paths. Without an official explanation, both scenarios are unsettling. The "white hat" angle Onchain self-identification as a "white hat" is a known tactic, particularly in DeFi, where attackers sometimes negotiate the return of funds while keeping a portion as a "bounty". The Euler Finance exploit in 2023 and the Poly Network incident in 2021 followed similar patterns. The key unknown is Blockstream's posture. So far, the company has not confirmed unauthorized access, denied an exploit, or acknowledged the transaction. Implications for federated sidechains Federated sidechains such as Liquid sit between Bitcoin's trust-minimized base layer and fully centralized custodial systems. Users typically accept trust in a set of validators in exchange for faster transfers and added functionality. If 11 of 15 functionaries can be compromised, or if the PAK mechanism can be circumvented, the assumptions behind Liquid's security model may need reevaluation. For Liquid users relying on the network for faster settlement, confidential transactions, or Liquid-native assets, the near-term question is straightforward: are the remaining reserves secure? In the absence of transparency from Blockstream, that question remains unanswered.

ME News reported that Bitcoin News monitoring on Sept. 7 (UTC+8) flagged an apparent simultaneous transfer of roughly 4,000 BTC out of about 4,200 BTC tied to a Liquid Network pegout transaction. A follow-up transaction carried an OP_RETURN message reading: "We are white hats; please contact us onchain." The purpose of the activity, and whether the funds were moved due to a vulnerability, has not been confirmed. (Source: ODAILY)

\u0027We Are Whitehats\u0027: Nearly 4,000 BTC Drained From Blockstream\u0027s Liquid Peg

U.S.-listed Bitcoin ETFs recorded their strongest monthly inflows since September 2025, pulling in more than $3.52 billion, according to SoSoValue data released this week. Total net assets climbed to $103.34 billion, equivalent to 6.32% of Bitcoin's market capitalization.

US spot Bitcoin exchange-traded funds posted net inflows of $174.6 million on Friday, Sept. 4, 2026, according to Farside Investors' daily data. The day's net intake came entirely from two products, with BlackRock's iShares Bitcoin Trust (IBIT) and the Fidelity Wise Origin Bitcoin Fund (FBTC) the only funds showing positive flows. The total was down 76.1% from Thursday, Sept. 3, when net inflows reached $730.8 million. The number of funds with positive inflows narrowed to two from seven out of the 12 tracked products. On Thursday, IBIT, FBTC, BITB, ARKB, MSBT, GBTC and BTC all recorded net inflows; by Friday, BITB, ARKB, MSBT, GBTC and BTC had shifted to flat readings. IBIT reported $117.4 million of net inflows, while FBTC added $57.2 million. The remaining ten funds—BITB, ARKB, BTCO, EZBC, BRRR, HODL, BTCW, MSBT, GBTC and BTC—each showed zero net flows. None recorded net outflows, indicating the slowdown reflected a reduced pace of new allocations rather than broad withdrawals. A zero net-flow figure does not mean a fund's shares did not trade. Fidelity notes that investors can buy and sell ETF shares during stock-market hours, while authorized participants separately create or redeem shares. The flow table captures the net fund-level creations and redemptions, not the volume of secondary-market trading. Markets now look to Tuesday, Sept. 8, for the next update, with Nasdaq and the NYSE closed on Monday, Sept. 7, for Labor Day. Friday's figures will remain the latest completed US exchange-session data through the holiday break. The holiday closure does not affect global Bitcoin trading, but it pauses the US-listed ETF trading window. The data do not identify the buyers behind the flows or attribute the deceleration to specific catalysts such as price moves or economic releases. The next completed session will indicate whether inflows broaden beyond IBIT and FBTC again; one day's reading is not enough to establish a durable demand trend.

Bitcoin mined as block rewards in March 2010 has resurfaced after more than 16 years of dormancy, reviving speculation over whether some of the network's earliest coins could be linked to Satoshi Nakamoto. On Saturday, several long-inactive addresses collectively moved about 600 BTC—roughly $48 million—based on on-chain data reviewed by Cointelegraph. The timing drew attention because it falls within the period when Nakamoto was still involved in Bitcoin's early development. Blockchain tracking firm Whale Alert said its analysis does not support a Satoshi connection. The company reported it could not link any of the 12 mining blocks tied to the transfers to Nakamoto. Key points - Around 600 BTC moved from dormant Bitcoin addresses after more than 16 years, according to Cointelegraph's review of on-chain monitoring. - Whale Alert traced the funds to 12 block rewards from March 2010, when the block subsidy was 50 BTC per block. - Whale Alert said none of the 12 blocks can be attributed to Satoshi Nakamoto based on its research. - The new review expands Whale Alert's earlier work that covered seven of the rewards. - Lookonchain had previously flagged seven miner wallets from the same March 2010 period, reinforcing the timeline. Whale Alert expands tracing to 12 March 2010 rewards Whale Alert told Cointelegraph it mapped all 12 reward events behind the wallets that became active on Saturday. Each originated from Bitcoin blocks mined in March 2010, when miners received 50 BTC per block. The historical context highlights how large early issuance was compared with today's rewards. Bitcoin's subsidy has been reduced over time through scheduled halving events. Most recently, in April 2024, the block reward fell from 6.25 BTC to 3.125 BTC following the 2024 halving. Why the Satoshi speculation surfaced—and why Whale Alert rejects it Interest intensified largely because the coins date to the so-called "Satoshi era," when Nakamoto was still publicly active in Bitcoin's communications and development. Cointelegraph has previously reported that the last known communication from Nakamoto dates to April 2011. Whale Alert argues that age and timing are insufficient to claim attribution. A spokesperson told Cointelegraph the firm's research finds no basis to connect the 12 blocks involved to Nakamoto. For market participants, the practical distinction is that "old coins"—or even "Satoshi-era" coins—are not necessarily "Satoshi coins." Narratives involving Nakamoto-linked holdings can amplify speculation even when evidence is thin or inconclusive. Transfer pattern suggests a test transaction Whale Alert also highlighted the sequencing of the movements: one of the 12 reward outputs was moved several blocks before most of the others. The firm said the pattern resembles a test transfer followed by subsequent moves from related addresses, rather than a single coordinated sweep. Such behavior can shape interpretations of motive. A test transaction may indicate the sender was confirming access or transfer pathways before moving larger amounts, while immediate consolidation often signals a different operational intent. Without private-key access or off-chain context, analysts rely on on-chain patterns. Cointelegraph also noted that Lookonchain previously identified seven miner wallets that moved 350 BTC after about 16.5 years of inactivity, attributing them to March 2010 mining—consistent with the broader timeline behind the latest activity. What to monitor next The episode underscores that early Bitcoin distribution can reappear on-chain after long inactivity. Even without a Satoshi link, large transfers from dormant addresses can influence sentiment around supply dynamics and fuel short-term speculation over whether more early holdings will move. Traders and investors are likely to watch for follow-on transactions from related early-era outputs and for additional attribution work that clarifies which entities mined specific blocks. This article was originally published as "SatoshiEra Bitcoin Moves After 16 Years Dormant, 600 BTC Shift" on Crypto Breaking News.