Liquid Network hackers return $268M in Bitcoin, keep $47M

The Liquid Network, a Bitcoin ↘ 1.73% sidechain used by cryptocurrency exchanges for fast settlement, was drained of roughly $320 million in bitcoin on Sunday after self-described white-hat hackers exploited a software bug, in one of the largest crypto security breaches this year.

Approximately 4,000 of the 4,200 bitcoin held in the Liquid Federation wallet were withdrawn, representing about 95 percent of the network's total reserves, the Liquid Network said in a post on X. The network immediately halted all new transactions and disabled bridge nodes while federation members began investigating.reuters

How the Exploit Worked

The breach did not involve stolen private keys or compromised credentials. Instead, a bug in Elements, the open-source software that powers Liquid, allowed the attackers to mint unbacked Liquid Bitcoin (L-BTC) from nothing, then redeem those tokens for real bitcoin through the network's standard peg-out process. The funds moved through SideSwap, an authorized settlement platform on the network, making detection harder because the transactions appeared legitimate.coincentral+2

The attackers communicated with Blockstream through messages embedded in bitcoin transactions using OP_RETURN. "Please fix the bug first," one on-chain message read. "Make sure every node is patched. Then we will transfer the money back safely after confirming the fix".theregister+1

Partial Return of Funds

By Monday, on-chain data showed the hackers had returned 3,400 BTC worth about $268 million to the Liquid Federation wallet, while keeping roughly 598.5 BTC valued at approximately $47 million. Blockstream patched its bridge nodes after identifying the Elements bug.gizmodo+1

Aneirin Flynn, chief executive of cybersecurity firm FailSafe, told Bloomberg that preliminary evidence pointed to a bug allowing the minting of L-BTC. "With roughly 95% of reserves drained and the network paused, the incident exposes a critical weakness in Liquid's validation and backing model," Flynn said.thestar

What's at Stake

Liquid Network was launched in 2018 by Blockstream, co-founded by cryptographer Adam Back, and now operates as a federation of more than 80 exchanges, infrastructure companies, and asset managers. Major users include BTSE and Bitfinex, which shares a parent company with Tether, the world's largest stablecoin issuer. Other assets on the network, including USDT, were not affected.businesstimes+2

The incident adds to a string of recent crypto security failures. Last month, the offline bitcoin wallet Coldcard was hacked, and last week $6 million was withdrawn from a digital asset lending platform linked to Crypto.com. Liquid Network has not disclosed a timeline for when full operations will resume.coincentral+1