The Liquid Network, Blockstream’s federated Bitcoin sidechain, recorded a 3,996.01834922 L-BTC peg-out at 14:06:10 UTC on 6 September 2026. That is not a screenshot rumor. The matching 3,996.01834922 bitcoin payment confirmed on Bitcoin at 14:28:56 UTC in block 965783.
As of our 22:56:39 UTC CoinGecko snapshot, Bitcoin (BTC) printed $80,014 (24h +0.27%). At that print the peg-out is about $319.7 million. Bitcoin is still hugging the $80,000 area we already wrote about. The Liquid peg is the new fact.
A follow-up spend sent 3,995.99999857 BTC to bc1ql4mfu6aundtkksxklfajs2h3t9nzcd6gyqjlte. Later that day an OP_RETURN on that cluster said “we are whitehats. contact us on chain.” That is a label on a transaction, not a completed incident report.
What happened
Liquid Bitcoin (L-BTC) is the sidechain’s bitcoin-backed asset. Users peg BTC in, hold L-BTC, then peg out to recover BTC on the main chain. The 6 September print is a large peg-out, not a quiet rebalance.
Blockstream’s Liquid explorer shows transaction ce4caece413cd9d444ce7ed9f54e5b328b3da5e4af301aff59a3571f76e988f2 confirmed in Liquid block 4050349 at 14:06:10 UTC. Output 1 burns 3,996.01834922 L-BTC as an OP_RETURN peg-out aimed at Bitcoin address bc1qgslsydz56d0ed6827hdemfmk5w2f6ldyc6wt7p. We pulled that record from the Liquid transaction on Blockstream.info at 23:10 UTC.
On Bitcoin, transaction 8db751a650ae2f12006b7e8c69a75e4df360e8afd6b9e05ae0b9fa6458a7b140 confirmed in block 965783 at 14:28:56 UTC. It has 83 inputs totaling 4,019.44426085 BTC. First output pays exactly 3,996.01834922 BTC to the same peg-out address. Many inputs spend a long P2WSH, bc1qdlld6antmv4xug242ed83q7k4rqw50cwfns38szx4qu2f4jwaxxsuhwxxr, the federated script that funded this batch. See the Bitcoin transaction on Blockstream.info.
In the same Bitcoin block, 85d2ca15bea33a592e73ed40c6a5da887feecf1e77f58ec7f580e00841645043 spends that 3,996.01834922 BTC output and sends 3,995.99999857 BTC to bc1ql4mfu…6gyqjlte. Explorer address stats as of 23:12 UTC show that destination still holds about 3,998.4984767 BTC. The coins did not vanish into a mixer in the first nine hours.
At 18:30:10 UTC, transaction c103de95817b43f2df635ec6f35ff126ca26a7c6d20570c4b01866b2b3e69a19 attached OP_RETURN text: “we are whitehats. contact us on chain.” At 19:31:47 UTC, 91271efcbb5ab29abfc38ae635f0644e3ba042aad56f92d40136e1dde4742fe8 attached “Please contact security at blockstream.com.” A later 20:38:14 UTC OP_RETURN named a Signal handle. We treat that last line as unauthenticated graffiti unless Blockstream repeats it in a signed note.
The Liquid L-BTC asset record (asset id 6f0279e9ed041c3d710a9f57d0c02928416460c4b722ae3457a11eec381c526d) still shows peg-in amount 18,356.87853979 BTC minus peg-out amount 18,149.60353198 BTC, or 207.27500781 BTC outstanding, when we read it at 23:12 UTC. The P2WSH that supplied the peg-out sat at 197.47185268 BTC on the same pull. Those two figures are not identical. They are both small next to the ~3,996 BTC that just left.
Context
A peg-out is supposed to look like this: L-BTC is destroyed on Liquid, then functionaries release matching BTC. Size is the shock. One ticket moved roughly 95% of the BTC that had been sitting behind L-BTC if you compare 3,996 to a ~4,200 BTC float implied by 207.275 plus 3,996.
Bitcoin Magazine reported the same Sunday peg-out, said Liquid paused bridge nodes, and said other issued assets such as USDT were unaffected, citing Liquid’s official account on X. We did not retrieve that X post. We did retrieve Blockstream’s public status page at 23:10 UTC. It still read “All systems are operational,” including Liquid RPC and Liquid REST. A status green light and a paused bridge can both be true if the explorer APIs are up while peg traffic is halted. They can also disagree. Until Blockstream’s blog or a signed security note says pause, we will not treat the status page as a pause, and we will not treat the magazine line as an on-chain fact.
This is still a bridge story in the old sense: BTC on one chain, a claim on another. L-BTC is not a user-held private key for the main-chain coins. It is a federated claim. When the claim set shrinks by 3,996 BTC in one print, counterparty risk stops being a glossary example and becomes the tape.
Spot Bitcoin itself barely moved relative to this size. Our snapshot had BTC at $80,014. Coinbase’s BTC-USD ticker at 23:10:01 UTC showed last $80,237.23, session high $80,346.12, low $79,250. That is the same $80,000 shelf, not a new range break. Ether printed $2,507.46 (+1.05%) on the same snapshot. The Liquid float is tiny next to Bitcoin’s market, and it is large next to anyone who treated L-BTC as cash-equivalent BTC.
If you hold L-BTC on an exchange, the first operational question is whether that venue paused deposits and withdrawals. Check the venue’s own status board rather than a recap thread. Our exchange and withdrawal status guide is the boring checklist for that. If you hold L-BTC in a wallet, you still need a working peg to turn it back into main-chain BTC. That peg is the part that just printed a 3,996 BTC ticket.
We are not repeating outlet theories about an inflation bug, a compromised SideSwap key, or a 15-member 11-of-15 signing story as facts. Those may be true. They were not on the explorer payloads we fetched. The on-chain objects we have are the peg-out, the Bitcoin payment, the sweep to 6gyqjlte, the whitehat OP_RETURN, and the security@ reply string.
Our read
I read this as a confirmed peg-out and an unconfirmed disclosure. The coins moved. The remaining L-BTC outstanding on the asset API is 207.275 BTC. “Whitehat” is marketing on an OP_RETURN until Blockstream publishes a note that names this transaction, says whether the peg-out was authorized, and says whether L-BTC holders can peg out again.
Do not trade the $80,000 Bitcoin print as if it digested a $320 million Liquid hole. Main-chain BTC did not have to sell into that peg-out. The BTC left a federation script and sat in a new address. That is not the same as spot selling on Coinbase. It is still a blow to the idea that federated BTC wrappers are sleepy plumbing.
Falsifiable claim: by 23:59 UTC on 9 September 2026, either (a) Blockstream’s blog or an official help/status incident names this 3,996.01834922 BTC peg-out and states whether it was unauthorized, or (b) address bc1ql4mfu6aundtkksxklfajs2h3t9nzcd6gyqjlte shows a confirmed balance under 100 BTC on Blockstream.info. If neither happens, the “still concentrated, still waiting on a real incident note” read is wrong.
What to watch
Watch Blockstream’s blog and the same status page. If Liquid RPC stays “operational” while peg-outs of ordinary size stop confirming, the pause is real even without a red banner. If a new incident row appears, that is the primary, not another recap.
Watch the 6gyqjlte balance and whether the 3,998.5 BTC splits, returns to the federation P2WSH, or hits a known mixer. A return to the P2WSH would be the cleanest “whitehat” ending. A quiet drain into fresh addresses would not.
Watch L-BTC outstanding on the asset API. If it jumps back toward 4,000 BTC without a matching peg-in story, ask which print you missed. If it stays near 207 BTC while wallets still show large L-BTC balances, the peg and the claim have diverged in a way holders will feel.
Watch venue notices for L-BTC, not for BTC. Bitcoin’s own history page is full of wrappers that worked until the peg was the story. This is that lesson on a Sunday, with timestamps.