A $320 Million Hack Exposes the Cracks in Crypto’s Plumbing
The $320 million hack of the Bitcoin-linked Liquid Network is another dent to crypto’s reputation as the industry tries to convince banks and institutional investors that digital assets can become part of mainstream financial infrastructure.
The damage extends beyond the Bitcoin that was taken. Liquid was built to make the largest cryptocurrency more useful for trading and settlement, and the incident highlights the risks in the layers surrounding a blockchain — the wallets, custody arrangements and transaction infrastructure that users ultimately have to rely on.
“Continued exploits reinforce to global fintechs and institutions that decentralized finance is still not ready for prime time,” said Nikhil Raghuveera, chief executive officer of Predicate, a blockchain compliance infrastructure provider. “Blockchains are great for financial settlement but DeFi is not ready for the institutional standards that are taken for granted in legacy markets.”
Ongoing hacks are exposing decentralization — once touted as one of crypto’s greatest strengths — as a vulnerability. By removing central authorities responsible for reversing mistakes, safeguarding assets and absorbing losses, the system leaves users dependent on fragmented infrastructure that malicious actors continue to find ways to attack.
Hacking incidents are increasing even if the overall amount lost isn’t. About $1.4 billion has been taken by hackers so far in 2026 across 250 attacks, compared with $2.7 billion over 146 attacks in 2025, according to DefiLlama data.
This year, 26 of the assaults, or over 10%, were on bridges and cross-chain infrastructure, connecting tools for users to move tokens or information from one blockchain to another. In 2025, DefiLlama identified only three hacks in this category.
Cross-chain links are a critical component of DeFi, enabling the automation of moving and converting different types of digital assets. But a myriad of cross-chain projects and a limited capacity for cybersecurity vetting has raised risks.
‘White-Hat Hackers’
The Liquid Network hack this week is the latest in a spate of breaches targeting decentralized platforms this year, including on Kelp DAO and Drift Protocol that together accounted for $588 million in losses.
Liquid said about 4,000 Bitcoin, or roughly 95% of the Bitcoin held in its main wallet, were drained by hackers who described themselves as “white hats,” a term for hackers who uncover security flaws with the aim of having them fixed, sometimes in exchange for a fee.
In this instance the hackers returned 3,400 of the Bitcoin, keeping about $47 million worth, according to Alex Thorn, head of research at crypto firm Galaxy Digital Inc. As the incident unfolded, the Liquid Hackers and Blockstream communicated through messages included in transactions on the Bitcoin blockchain. Dialogue was still ongoing by Tuesday morning in New York, according to Galaxy Research.
The authorization key for the settlement platform used in the hack wasn’t compromised, according to Liquid, making the episode a reminder that even when the underlying blockchain continues to operate, the systems built around it can fail.
💧 LIQUID WHITE HATS SAY Treplace’LL RETURN ‘MOST’ OF 4000 BTC ONCE LIQUID NETWORK BUG IS PATCHED
the hackers have been conversing with blockstream via OP_RETURN messages and PGP encrypted text
– block 965,822 blockstream address sent 1,000 sat with “Please contact security at… pic.twitter.com/VP8IkOvftl
— Alex Thorn (@intangiblecoins) September 7, 2026
Just last week, an attacker drained $6 million from a Crypto.com-linked digital-asset lending platform, and in August a hack of the popular offline Bitcoin wallet Coldcard raised questions about the safest way to store the digital asset.
Even when the industry has a highly secure underlying network, investors could be exposed through the applications and intermediaries sitting on top of it.
“These incidents demonstrate the vulnerabilities sit at operational and infrastructure layers, not the base consensus mechanisms,” said Ziqing Ang, head of policy in APAC at TRM Labs.
That creates a particular challenge as traditional finance moves deeper into crypto.
A bank considering tokenized deposits or securities, for example, isn’t only assessing whether the blockchain is secure. It also needs confidence in the custody system, smart contracts, settlement mechanism and entities responsible for controlling assets.
“A vulnerability in one piece of infrastructure can affect multiple businesses that rely on it,” said Raghuveera. “An exchange using a compromised bridge, a wallet holding the affected token or a market maker providing liquidity can suddenly find itself exposed even if its own systems were never breached.”
Even though the majority of the Bitcoin taken in the Liquid hack was returned, that “does not change the nature of the risk,” said Aneirin Flynn, chief executive of cybersecurity technology firm FailSafe.
“This attack could just as easily have been carried out by a malicious group with no intention of returning the funds,” Flynn said. “The fact that millions of dollars could be extracted because of a bug in the code points to software vulnerabilities as a durable risk for crypto infrastructure.”
Paradox
That is the paradox facing crypto as it matures — the industry was created to reduce the need for trust in financial intermediaries, but its institutional future increasingly depends on trusting the infrastructure built around blockchains.
The cost of a loss of confidence could be higher security requirements, greater demand for insurance and capital buffers, more diversification among custodians and settlement networks — or simply a slower pace of institutional adoption.
Crypto has spent years arguing that blockchains can provide a more efficient financial rail. The Liquid hack is another reminder that the rail itself may only be as trustworthy as the infrastructure carrying the assets on top of it.
Photo: Photographer: Chan Long Hei/Bloomberg