Alex Thorn, Head of Research at Galaxy Digital, is reported to have commented on the actors who stole funds from the Liquid Federation, linking the incident to a large on-chain Bitcoin movement that appeared in block 965950. As of press time, the substance of his statement and the ownership of the wallets involved in the transfer remain unconfirmed, and this account of the Liquid Federation fund theft rests on partially corroborated evidence.

Key points

• Attributed statement: Alex Thorn is reported to have commented on the actors behind the Liquid Federation fund theft; the full wording has not been independently retrieved.
• Reported theft: Earlier coverage attributes a large Bitcoin peg-out from the Liquid Network to unknown actors, processed through SideSwap.
• Verification status: Raw block data confirms a 3,400 BTC output in block 965950, but wallet ownership and any completed Federation recovery are not verified.

Alex Thorn's Comments on the Liquid Federation Hackers

The headline identifies Thorn as Galaxy Digital's Head of Research and attributes to him a statement about the actors who drained funds from the Liquid Federation, positioning him as the source connecting an off-chain negotiation to an on-chain return.

Earlier reporting attributed to Thorn describes an OP_RETURN and PGP exchange in which Blockstream contacted the actors at block 965822 and the actors responded at block 965869, with a later 3,400 BTC output appearing in block 965950. That earlier account described a promise to return most funds after a fix, not a completed transfer.

What Thorn Said

The complete statement in which Thorn is said to confirm a finished return has not been directly retrieved. According to unconfirmed reports, he stated that the funds were returned to the original Liquid Federation address after the OP_RETURN communication, but no completed-return statement by Thorn has been independently sourced. No direct quotation is available, and none is reconstructed here.

What Is Known About the Reported Fund Theft

The theft description traces to the supplied headline and to September 7 incident coverage. ForkLog reported that SideSwap received 4,000 L-BTC on September 6 and that the Federation paid 3,996 BTC following a valid peg-out authorization — an attributed claim rather than an audited root cause. SideSwap said its systems and peg-out authorization key were not compromised.

The incident sits alongside prior reporting that the Liquid sidechain was paused after roughly 3,998 BTC left a Federation wallet, and that the Liquid Network paused following a reported $320 million Bitcoin withdrawal. Those accounts frame the peg-out mechanics but do not document the specific return transaction.

Incident Details

On-chain, the return-side movement is concrete. Raw block data from Blockchain.info places transaction a6d697a2…bc49a46d in Bitcoin block 965950, whose hash is 0000000000000000000142bb6a9a03aaebf6ef42efd646864ed7910d0a66ee44. Output index 1 contains exactly 340,000,000,000 satoshis, or 3,400 BTC.

That output pays to bc1qdlld6antmv4xug242ed83q7k4rqw50cwfns38szx4qu2f4jwaxxsuhwxxr, and a second output returns 598.49955894 BTC to the input address bc1ql4mfu6aundtkksxklfajs2h3t9nzcd6gyqjlte. The raw fields prove amounts and addresses, not the identities behind them.

The block timestamp is 1788797365 Unix seconds, or 2026-09-07 16:09:25 UTC, and the block carried 4,280 transactions. The destination is claimed to be the original Liquid Federation wallet, but that attribution requires corroboration; bare transaction data does not establish ownership.

For architecture context, Liquid's August 15, 2023 announcement describes Watchmen managing the pegged-Bitcoin multisignature wallet, delivering peg-outs, and sweeping controlled UTXOs before expiry. That is historical design detail, not a current incident postmortem. The Watchmen model is what distinguishes Liquid from trust-minimized Bitcoin transfers on the base chain: peg-outs depend on a quorum of Federation members rather than on individual user keys, which is why a compromised or exploited peg-out authorization can move large amounts in a single action.

What Still Needs Confirmation

The core unresolved point is attribution. No independently sourced statement from Thorn confirms a completed 3,400 BTC return, and the sender and recipient addresses have not been tied to the incident actors or the Federation through verified OP_RETURN transcripts or PGP signatures. On-chain analysts often resolve such questions by tracing the movement of the two output addresses in subsequent blocks; no such follow-on tracing appears in the supplied material.

Remediation status is also open. The Cyber Express reported that Ledger CTO Charles Guillemet initially questioned the actors' white-hat characterization, then expressed greater hope of recovery after their communication with Blockstream; his original statement was not directly fetched. Reports discuss return conditions, not confirmed patching across the network.

These are gaps in the supplied material rather than proof that the facts are unavailable publicly. For DeFi and peg-based liquidity users, the operative risk is custody concentration in the Federation multisig and the absence of a confirmed remediation timeline; a completed return should not be treated as established until an official postmortem or a directly sourced Thorn statement corroborates the on-chain movement.

A verified transfer-time valuation is also missing, and the current Bitcoin spot snapshot near $79,078 cannot substitute for the value at the moment the output confirmed.