A single Bitcoin transaction moving 3,400 BTC has been tied by an unconfirmed headline to Galaxy Digital Head of Research Alex Thorn and an alleged theft from the Liquid Federation, but the o
A single Bitcoin transaction moving 3,400 BTC has been tied by an unconfirmed headline to Galaxy Digital Head of Research Alex Thorn and an alleged theft from the Liquid Federation, but the only part independently verifiable on-chain is the transfer itself. For traders across Southeast Asia watching Bitcoin custody risk, the case shows how quickly an on-chain movement gets wrapped in a narrative the data does not yet support.
The circulating headline names Alex Thorn, identified as Galaxy Digital Head of Research, as the source of a claim that hackers who stole funds from the Liquid Federation returned Bitcoin to an original Federation address. The wording available to us stops before the statement is complete, and no original post or direct attribution has been located. For related coverage, see PolyNext Awards & Conference Dubai 2026: Advancing the Global Dialogue on Plastic Recycling and Circularity.
TLDR Keypoints
According to unconfirmed reports, Thorn linked the returned Bitcoin to an attacker communicating with Blockstream via OP_RETURN before sending the funds back. No public statement, message transaction, or decoded OP_RETURN text has been obtained to confirm this, so the attribution should be read as an unverified claim rather than an established quote. For related coverage, see AINext Awards & Conference Dubai 2026: Where AI Leaders, Innovators and Decision-Makers Shape the Future of Artificial Intelligence.
The headline refers to hackers who stole funds from the Liquid Federation, the multi-party operator group behind the Bitcoin sidechain. Blockstream's May 11, 2026 roadmap describes Liquid as a production deployment of Elements run by a 15 functionary operator set managing Bitcoin peg-in outputs, useful background but not confirmation of any theft. For related coverage, see AgriNext Awards & Conference Dubai 2026: Where Agriculture Leaders, Innovators and Investors Shape the Future of Food Systems.
The name Liquid Federation is preserved as supplied; its identity and relationship to the Liquid Network are not established by the headline alone. The Federation's own Q1 2026 update reported 87 members and 14,063 peg-ins totaling 1,252 BTC, historical operating figures that do not describe any incident balance.
Crucially, the available material does not specify the amount originally stolen, the attack method, or the timing of any breach. We are not adding hacker identities, affiliations, laundering routes, or recovery claims that the evidence does not support.
What can be verified is one Bitcoin payment. Output index 1 of transaction a6d697...9a46d pays exactly 3,400 BTC, confirmed in block 965950, per the on-chain record. Both the sending and receiving addresses remain unattributed.
Verified Bitcoin transaction output
3,400 BTC
Output index 1 contains 340,000,000,000 satoshis (3,400 BTC), confirmed in Bitcoin block 965950 on September 7, 2026 at 16:09:25 UTC. Wallet ownership and attribution as a return of stolen Liquid Federation funds remain unverified.ON-CHAIN DATA
Notably, this transaction has two outputs and neither carries an OP_RETURN script, so the alleged Blockstream negotiation, if it happened, would sit in separate transactions that have not been produced. No transfer-time USD value was recorded; Bitcoin traded at $79,185 in the current snapshot, which is not the value at the time of the move.
The headline ends with an ellipsis after Liquid Federation, and no supporting research text accompanies it. To turn this into a substantiated report, the full Thorn statement, its original publication venue, and its date are all needed.
Beyond the statement itself, the incident's entity identification requires source material linking either address to the Federation or to an attacker. The original theft transaction, the exploit method, and the share of funds recovered are all missing from the evidence at hand.
For regional readers, the takeaway is procedural. Southeast Asian venues such as Indodax, Tokocrypto, and Coins.ph increasingly custody Bitcoin against sidechain and bridge exposure, and this episode is a reminder to trace claims back to explorers, as the earlier Coldcard hacker fund movements showed. It also connects to ongoing coverage of the Liquid Network's roadmap and market outlook. Until an official Federation confirmation appears, the 3,400 BTC transfer stands as verified data attached to an unverified story.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
Read original article on kanalcoin.com
