Purported white-hat hackers drain $320M from Liquid Network

Purported white-hat hackers drained approximately 4,000 bitcoin — roughly $320 million — from the Liquid Network's federation wallet on Sunday, prompting the Bitcoin sidechain to pause all network activity as Blockstream scrambles to contact the attackers.

The withdrawal represented about 95% of Liquid's reported bitcoin reserves, which stood at roughly 4,200 BTC before the incident. The federation wallet now holds just over 207 BTC, according to Blockstream's proof-of-reserves page.bitcoinmagazine+1

How It Happened

The funds were withdrawn through the SideSwap Peg-out Authorization Key, though Liquid said neither that key nor any others were compromised. SideSwap, a federation member that performs peg-outs on behalf of users, confirmed its key was not breached and said Blockstream had determined "the L-BTC in that order was created through a bug in the Elements software".theblock+1

According to Bitcoin ↘ 1.28% Magazine, the attackers appear to have exploited an inflation bug on the sidechain to mint more than 4,000 LBTC that did not previously exist, then redeemed them for real bitcoin from the federation's 11-of-15 multisig wallet. Because the transactions appeared valid under the flawed consensus rules, the federation members' hardware security modules signed the withdrawal automatically.cryptorank+1

Two transactions confirmed in block 965,780 moved the funds to a single address, according to The Defiant. Four hours later, the recipient consolidated the bitcoin and attached a message via the OP_RETURN data field: "we are whitehats. contact us on chain". Blockstream responded on-chain with a message directing the hackers to its security email. A separate transaction from a third party offered a Signal contact, though JAN3 CEO Samson Mow noted that message "did not come from the same address" holding the funds.thedefiant

Fallout and Response

Bridge nodes have been disabled, effectively freezing the sidechain. Exchanges were told to pause LBTC deposits and withdrawals. Other assets issued on Liquid, including Tether (USDT), DePix and tokenized real-world assets, were unaffected.tradingview+1

Mow said Aqua wallet's Liquid features were impacted but that on-chain bitcoin transactions continued to function. "Everyone is actively working to resolve this," he wrote. "These are difficult times but we'll pull through".lcx

Ledger chief technology officer Charles Guillemet questioned whether the conduct matched responsible disclosure. "White hats don't drain a bridge and then solicit an 'on-chain' contact," he wrote, before allowing that "this could be people with good intentions that intensively played with recent LLMs and are not used to responsible disclosures".thedefiant

What Comes Next

Users holding LBTC have limited options. The underlying bitcoin is not redeemable while the network remains paused, and the confidential nature of Liquid transactions makes it difficult to determine how much LBTC is held by retail users versus institutions. Crypto analyst DBCrypto noted the coins have not been mixed and remain stationary on-chain, behavior "more consistent with a whitehat extraction than a theft".bitcoinmagazine+1

Blockstream had published a roadmap in May that included work on a "BitVM-style 1-of-n bridge" designed to reduce reliance on the federated multisig. That system is not yet live — and Sunday's withdrawal went out through the very architecture it was meant to replace.thedefiant