Liquid Global Hot Wallet Breach

On August 19, 2021, Liquid Global — a Japan-headquartered cryptocurrency exchange — disclosed that its warm wallets had been compromised. Total loss: approximately $97 million across ETH, XRP, BTC, stablecoins and various ERC-20 tokens, of which ~$45M was on Ethereum.

What happened

Liquid stored most reserves in cold storage, but operated warm wallets with significant balances to service routine withdrawals. The warm wallets were compromised by an attacker who obtained the relevant private keys — exact vector never publicly disclosed.

Once inside, the attacker swept the warm wallets across multiple chains in a coordinated sequence. A meaningful portion of the stolen ERC-20 tokens was rapidly converted into ETH on Uniswap and other DEXs — specifically to escape token-issuer freezes, which would have been possible for many of the long-tail ERC-20s if the attacker had held them as-is.

Aftermath

• Liquid moved remaining assets into cold storage and paused operations.
• Within six days, FTX extended a $120 million loan to Liquid to cover withdrawal demand and keep the exchange operating.
• FTX subsequently acquired Liquid outright for an undisclosed sum, completing the transaction in February 2022.
• A former Liquid employee later publicly disputed the company's internal attribution of the breach, claiming she had been scapegoated for what was actually a broader operational failure.

Why it matters

Liquid is one of a handful of exchange compromises that ended in acquisition rather than collapse. The path — major hack → emergency liquidity from a bigger exchange → outright purchase — became a recurring pattern through the 2021-2022 bull run (FTX-Liquid, FTX-BlockFi, Binance-Aax, etc.). When FTX itself collapsed in November 2022, Liquid customers became downstream creditors of the FTX bankruptcy, recovering funds on FTX's timeline rather than their own. The acquisition that had once felt like a rescue became a second contagion event.