Alex Thorn on Hackers Behind Liquid Federation Fund Theft

Galaxy Digital Head of Research Alex Thorn is reported to have commented on the hackers who stole funds from the Liquid Federation, tying the incident to a large on-chain Bitcoin movement that surfaced in block 965950. The substance of his statement, and the ownership of the wallets involved in the transfer, remain unconfirmed as of press time, and this account of the Liquid Federation fund theft rests on partially corroborated evidence.

Alex Thorn’s Comments on the Liquid Federation Hackers

The headline identifies Alex Thorn as Galaxy Digital’s Head of Research and attributes to him a statement about the actors who drained funds from the Liquid Federation. The framing places him as the source connecting an off-chain negotiation to an on-chain return. For related coverage, see Bitcoin fund flows reflect Fed rate bets: CoinShares.

Earlier reporting attributed to Thorn describes an OP_RETURN and PGP exchange in which Blockstream contacted the actors at block 965822, and the actors responded at block 965869, with a later 3,400 BTC output appearing in block 965950. That earlier account described a promise to return most funds after a fix, not a completed transfer. For related coverage, see AINext Awards & Conference Dubai 2026: Where AI Leaders, Innovators and Decision-Makers Shape the Future of Artificial Intelligence.

What Thorn Said

The complete statement in which Thorn is said to confirm a finished return has not been directly retrieved. According to unconfirmed reports, he stated the funds were returned to the original Liquid Federation address after the OP_RETURN communication, but no completed-return statement by Thorn was independently sourced. No direct quotation is available, and none is reconstructed here. For related coverage, see AgriNext Awards & Conference Dubai 2026: Where Agriculture Leaders, Innovators and Investors Shape the Future of Food Systems.

What Is Known About the Reported Fund Theft

The theft description traces to the supplied headline and to September 7 incident coverage. ForkLog reported that SideSwap received 4,000 L-BTC on September 6 and that the Federation paid 3,996 BTC following a valid peg-out authorization, an attributed claim rather than an audited root cause. SideSwap said its systems and peg-out authorization key were not compromised.

The incident sits alongside prior reporting that the Liquid sidechain was paused after roughly 3,998 BTC left a Federation wallet, and that the Liquid Network paused following a reported $320 million Bitcoin withdrawal. Those accounts frame the peg-out mechanics but do not document the specific return transaction.

Incident Details

On-chain, the return-side movement is concrete. Blockchain.info raw block data places transaction a6d697a2…bc49a46d in Bitcoin block 965950, whose hash is 0000000000000000000142bb6a9a03aaebf6ef42efd646864ed7910d0a66ee44. Output index 1 contains exactly 340,000,000,000 satoshis, or 3,400 BTC.

Bitcoin transaction output

3,400 BTC

That output pays to bc1qdlld6antmv4xug242ed83q7k4rqw50cwfns38szx4qu2f4jwaxxsuhwxxr, and a second output returns 598.49955894 BTC to the input address bc1ql4mfu6aundtkksxklfajs2h3t9nzcd6gyqjlte. The raw fields prove amounts and addresses, not the identities behind them.

The block timestamp is 1788797365 Unix seconds, or 2026-09-07 16:09:25 UTC, and the block carried 4,280 transactions. The destination is claimed to be the original Liquid Federation wallet, but that attribution requires corroboration; bare transaction data does not establish ownership.

For architecture context, Liquid’s August 15, 2023 announcement describes Watchmen managing the pegged-Bitcoin multisignature wallet, delivering peg-outs and sweeping controlled UTXOs before expiry. That is historical design detail, not a current incident postmortem.

What Still Needs Confirmation

The core unresolved point is attribution. No independently sourced statement from Thorn confirms a completed 3,400 BTC return, and the sender and recipient addresses have not been tied to the incident actors or the Federation through verified OP_RETURN transcripts or PGP signatures.

Remediation status is also open. The Cyber Express reported that Ledger CTO Charles Guillemet initially questioned the actors’ white-hat characterization, then expressed greater hope of recovery after their communication with Blockstream; his original statement was not directly fetched. Reports discuss return conditions, not confirmed patching across the network.

These are gaps in the supplied material rather than proof that the facts are unavailable publicly. For DeFi and peg-based liquidity users, the operative risk is custody concentration in the Federation multisig and the absence of a confirmed remediation timeline; a completed return should not be treated as established until an official postmortem or a directly sourced Thorn statement corroborates the on-chain movement.

A verified transfer-time valuation is also missing, and the current Bitcoin spot snapshot near $79,078 cannot substitute for the value at the moment the output confirmed.

Additional source references: source document 1.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.