Liquid Network Federation Wallet Drained of 4000 BTC in Alleged White-Hat Exploit Exposing L-BTC Minting Flaw
On September 7, the Liquid Network Bitcoin sidechain was hit by an attack that drained its Federation wallet of roughly 4000 Bitcoin, valued at approximately $320 million or 2.1 billion RMB, leaving only about 200 BTC in reserves. This represented a 95% loss of the network's backing assets overnight.
The incident was first noticed through an official post on X confirming that the Liquid Federation wallet had been compromised. Funds were transferred out via the authorized SideSwap settlement platform, yet Liquid emphasized that SideSwap keys remained secure and that the PAK (Pegin Authorization Key) itself was not leaked.
Security researchers, including FailSafe CEO Aneirin Flynn, identified preliminary evidence pointing to a vulnerability that permitted unauthorized minting of L-BTC. In the Liquid Network model, L-BTC is issued 1:1 against locked Bitcoin held in the federation wallet; any flaw allowing free minting of L-BTC effectively lets an attacker exchange phantom assets for real Bitcoin.
Officials described the perpetrator as a claimed white-hat hacker who allegedly planned to return the funds in exchange for a fee. This narrative echoes past cases such as the 2021 Poly Network incident, where $610 million was moved and later largely returned, though many similar events end with permanent loss.
The attack has forced Liquid to suspend all new transactions while federation members, including major exchanges BTSE, Bitfinex, and BitMEX, work on remediation. The event highlights a shift in 2026 crypto threats from stealing private keys to compromising asset-issuance and consensus logic, evidenced by the recent Coldcard random-number-generation flaw that enabled theft of over 1755 BTC.
Industry data for the first half of 2026 already records $972 million stolen across 207 incidents, marking a record half-year high. Experts warn that the Liquid case exposes fatal gaps in verification mechanisms and multi-signature federation controls that traditional audits often overlook.
Related articles
Lazarus Group Behind Record $6.3 Billion Binance Hot Wallet Theft: Anatomy and Cassandra Index Impact
Binance reported on October 29, 2026, that attackers stole approximately $6.3 billion in digital assets from its hot wallets, surpassing the previous record of $1.5 billion taken from Bybit in February 2025. The FBI attributed the breach to the TraderTraitor group, widely identified as the North Korean Lazarus Group, which has a history of high-profile operations including the 2014 Sony Pictures attack. The stolen tokens are being converted to Ethereum and laundered through decentralized finance platforms and instant exchangers. Binance covered 90 percent of losses using its SAFU fund, futures insurance reserves, and corporate treasury totaling around $6.34 billion, though this represents replacement of assets rather than recovery from the attackers. Blockchain analysis by TRM Labs linked the operation to prior campaigns against Bybit and KelpDAO through timing patterns and preparatory withdrawals via Tornado Cash. The incident contributed 2.3 percentage points to the Cassandra Index rise to 72, with the largest regional impact observed in East Asia.
Binance Confirms Record $6.3 Billion Crypto Theft via Compromised Hot Wallet and EIP-7702
Binance reported on October 30, 2026 that attackers stole approximately 6.3 billion dollars in cryptocurrency, equivalent to roughly 34 billion reais, marking the largest theft in the sector. The unauthorized transfers occurred on October 29 and were completed in about 20 minutes after the attacker compromised the system authorizing withdrawals. According to TRM Labs, the intruder leveraged Ethereum's EIP-7702 feature to seize control of a hot wallet following at least 36 hours of preparation. Initial reports pointed to a compromised DevOps engineer's laptop as the entry point, but the exchange later stated the incident involved multiple factors and was not a single-click action. Roughly 3 billion dollars have been traced, with Tether freezing over 1.57 billion USDT and Circle blocking more than 800 million USDC. Binance has committed to covering all losses through its SAFU fund and internal capital while cooperating with the FBI and U.S. Secret Service. Attribution remains disputed, with TRM Labs and Chainalysis linking the operation to the TraderTraitor group connected to Lazarus, though Binance has not confirmed the perpetrators.
EIP-7702 Explained: How Ethereum's New Signature Standard Enables Persistent Wallet Delegation Attacks
EIP-7702, activated in May 2025 as part of the Pectra upgrade, allows Externally Owned Accounts to delegate execution to smart contract code while retaining their original address and private key. The mechanism introduces powerful features such as batch operations, gas sponsorship, and limited permissions, but also creates new attack surfaces when users sign malicious delegations. Attackers exploit social engineering to obtain EIP-7702 authorizations that install sweeper contracts capable of draining ETH, ERC-20 tokens, and NFTs without further signatures. Unlike ERC-20 approvals, the delegation persists on-chain until explicitly revoked and can affect future incoming funds across multiple networks when chain_id is set to zero. Research from 2026 identified over 900 malicious delegated accounts linked to more than $2.3 million in confirmed losses. The standard itself is not inherently vulnerable; risk stems from unsafe contract implementations and user errors when signing authorizations. Users are advised to verify delegations via Etherscan or eth_getCode and revoke them through trusted wallet interfaces when necessary.
Binance Ethereum Hot Wallets Drained of Over $5.5 Billion via EIP-7702 Delegation Attack
On October 29, attackers drained between $2.5 and $3.5 billion in ETH and tokens from Binance hot wallets on Ethereum within 40 minutes, with the total including Bitcoin and Tron reaching at least $5.57 billion according to Decrypt. The attacker did not steal private keys directly but instead used EIP-7702 to delegate execution code from a malicious contract to Binance 14, allowing a single sweep call to transfer all assets. Tether and Circle froze roughly $2.5 billion in USDT and USDC within the first hours, while Binance stated user funds remain secure and investigations continue. Blockchain analysis reveals 18 hours of preparation including three test runs on external wallets funded via Tornado Cash, followed by the main delegation and sweep in just over three minutes. The attack shares strong operational similarities with previous incidents attributed to TraderTraitor, a Lazarus subgroup, including gas funding patterns, test sweeps, and the use of a sweep function. ETH was moved first to an address that has not yet dispersed funds, while stablecoins were fragmented across new wallets before partial freezes took effect.