Liquid Network has recovered 3,400 BTC (about $268 million) after an exploit drained nearly 4,000 BTC (about $320 million) from its federation wallet. The attacker, who identified as a "white hat," retained 598.5 BTC (about $47 million) in an address linked to the withdrawal, representing roughly 15% of the stolen funds.

The incident stemmed from a range-proof verification cache bug in Elements, the open-source software powering Liquid nodes, which allowed the creation of unbacked L-BTC tokens. No private keys or federation wallets were compromised; instead, attackers exploited the issuance logic to generate valid-looking tokens that were then pegged out via SideSwap, draining 95% of Liquid’s Bitcoin reserves.

Liquid immediately froze network operations and disabled bridge nodes to secure the remaining assets. The network remained paused while node operators updated their bridge software and verified the security fixes.

Communication between the attacker and Blockstream occurred entirely on-chain via Bitcoin OP_RETURN messages.

The hacker consolidated the stolen Bitcoin into a single address and broadcasted an OP_RETURN message reading: "we are whitehats. contact us on chain."

Blockstream established formal contact around Bitcoin block 965,822 by embedding encrypted text and a PGP signature in an OP_RETURN transaction.

The attacker sent encrypted details of the exploit back to Blockstream, stating they would not return the funds until the bug was fully patched across all network nodes.

Blockstream replied with a PGP-signed OP_RETURN message confirming against their official key on record: "Bridge nodes are patched, safe to return the funds," after which the attacker broadcast the return transaction.

While the return mitigated immediate insolvency risks, Liquid Network operations remain paused to restore 1:1 backing, and the status of the retained $47 million remains unclear, with no formal bounty agreement published.

Liquid official communications referred to the actor as a "purported white-hat hacker." Security experts and crypto community members heavily debated labeling the hacker a true "white hat," noting that taking funds by force prior to negotiations is extortion rather than responsible disclosure.

The Islamic Revolutionary Guard Corps (IRGC) attacked six vessels Saturday, after U.S. Central Command (CENTCOM) struck three Iranian oil tankers. The IRGC claimed it targeted three oil tankers transiting the Strait of Hormuz on "unauthorized" routes and three U.S.-affiliated ships in other areas, using anti-ship missiles.

CENTCOM announced earlier that U.S. forces had "permanently disabled" two Iranian crude carriers and "completely destroyed" a third after the IRGC launched ballistic missiles at a U.S. aircraft carrier and a guided-missile destroyer, which successfully evaded the attacks with no American personnel harmed, CENTCOM claimed.

This exchange marks a significant escalation in the U.S.-Iran conflict that began in late February 2026. The strikes on Saturday, were part of a new U.S. "tanker for tanker" policy, first implemented earlier in the week week when the U.S. hit two Iranian government tankers in response to IRGC attacks on commercial shipping in the Strait of Hormuz.

Trump administration executed a targeted operational shift from striking military sites (such as radars or launchers) toward hitting Iran's commercial oil assets. Using a combination of Navy and Air Force fighters and drones, CENTCOM struck three Iranian crude oil tankers

M/T Downy was struck at the stern off Kharg Island (Iran’s primary crude export hub) and "permanently disabled." M/T Stark 1 struck at the stern near the coastal city of Jask and also "permanently disabled." And M/T Kylo (Noxen), an unladen tanker struck in multiple critical areas in the Gulf of Oman, rendering it inoperable; it subsequently sank.

CENTCOM claimed the targeted tankers was part of a "multibillion-dollar shadow network" funding the IRGC and its regional proxies.

"Let the message to the IRGC be clear: If you shoot at two of our ships, we will impose an even higher economic cost—taking out three of yours," CENTCOM's Admiral Brad Cooper said in a statement. "We will not hesitate to defend American forces, and if necessary, destroy Iran’s limited and exposed oil fleet."

The IRGC Navy warned other vessels not to transit the strait via "unauthorized" waterways, threatening to target them. Iran’s Foreign Ministry condemned the U.S. strikes as "illegal and aggressive" violations of the UN Charter, while Iranian state media confirmed the crew evacuations from the hit tankers.

Defense Secretary Pete Hegseth posted on social media, "If Iran shoots at U.S. ships, we will destroy (and sink) their oil tankers." President Donald Trump had earlier described the conflict as "small potatoes" and declared the Strait of Hormuz "open."

The Strait of Hormuz is the world's most critical oil transit chokepoint, normally handling ~20% of global petroleum. Tensions escalated sharply after a naval blockade and military actions effectively closed off unapproved shipping routes.

US shift to "Tanker-for-Tanker" warfare, transitioning from neutralizing offensive threats (like mine-laying capabilities and coastal radar installations) to targeting the "shadow network" fleet that generates revenue for the IRGC, observers say, is likely to exacerbate the global energy crisis.