White hats or hostage holders? On Sept 6 about 4000 $BTC around 320 million dollars left Liquid Networks federation wallet the Bitcoin sidechain that backs L BTC. That is about 95 percent of its 4200 BTC reserves. No keys were stolen. A bug in Elements Liquids open source software let someone mint unbacked L BTC. SideSwap processed a normal peg out and the federation released real BTC. The network paused exchanges halted L BTC moves. Other assets were fine. Bitcoins base layer was untouched. The actors left an on chain message we are whitehats contact us on chain. They are talking to Blockstream via signed Bitcoin transactions and say they will return most funds after the bug is patched and every node updated. Some like Ledgers CTO doubt the white hat label real ones usually report first not drain then negotiate. $BTC itself barely blinked trading near 79k to 80k with only mild daily moves. This shows sidechain risks without shaking Bitcoins core security or price. If the coins return it becomes a rare test then refund story. If not it is just another expensive lesson in layered systems.