Key Points
- Self-identified whitehat attackers have returned 3,400 of approximately 4,000 BTC stolen from Liquid Network’s federation reserves over the weekend
- Roughly 598 BTC, valued at approximately $47 million, has not yet been returned
- The exploit emptied nearly all of Liquid’s 4,200 BTC backing, creating an immediate shortfall for L-BTC token holders
- Communication between Blockstream and the attackers occurred via signed messages within Bitcoin blockchain transactions
- Liquid Network operations continue to be suspended as security patches are implemented and restart procedures are finalized
Blockstream’s Liquid Network, a Bitcoin layer-2 solution, experienced a significant security breach over the weekend when malicious actors extracted approximately 4,000 Bitcoin from the federation’s custody wallet. This wallet serves as the backing mechanism for L-BTC, maintaining a 1:1 peg with the sidechain’s primary asset.
Following the exploit, only 197 BTC remained in reserves from an initial holding of roughly 4,200 BTC. This dramatic depletion meant L-BTC immediately lost its full collateralization.
Network operators responded swiftly to the crisis. They shut down bridge infrastructure, halted all network activity, and coordinated with cryptocurrency exchanges to suspend L-BTC deposit and withdrawal functionality. The breach did not impact other digital assets operating on Liquid, such as tether.
The individuals behind the attack claimed to be ethical hackers operating with good intentions. They indicated their willingness to restore the stolen assets after receiving confirmation that the security flaw had been resolved and all network nodes had implemented necessary updates.
Blockstream initiated communication by incorporating cryptographically signed messages within Bitcoin transactions. Both parties conducted transparent negotiations on the blockchain.
Majority of Stolen Funds Returned
Following Blockstream’s verification that bridge infrastructure had received security patches, the attackers transferred 3,400 Bitcoin back to the federation’s custody wallet. This amount represents roughly 85% of the total funds extracted.
Samson Mow, CEO of JAN3 and former Blockstream executive, verified the return on Monday. He noted that approximately 598 BTC remains unaccounted for and that discussions with the group are ongoing.
Based on current market valuations, the recovered Bitcoin has a value of around $270 million. The 598 BTC still controlled by the attackers carries an approximate value of $47 million.
The initial unauthorized withdrawal was executed using SideSwap’s Peg-out Authorization Key. Representatives from both Liquid and SideSwap clarified that the key itself was not breached or compromised.
According to SideSwap, the security weakness originated from a flaw within Elements, the open-source codebase that powers Liquid Network.
Debate Around Ethical Hacking Classification
The designation of these attackers as whitehats has sparked controversy within the crypto community. Charles Guillemet, chief technology officer at Ledger, voiced skepticism following the partial fund recovery.
He suggested that if the unreturned 600 BTC represents some form of negotiated compensation, the situation resembles extortion rather than responsible disclosure.
Blockstream has not officially characterized the outstanding Bitcoin as a bug bounty payment. The organization has also refrained from revealing any specific terms regarding repayment or compensation.
As of Monday, the network continues to remain offline. Blockstream and federation participants are addressing additional security measures, resolving blockchain fork issues, and coordinating the technical requirements for network reactivation.
Mow emphasized that users should take no action currently. He specifically cautioned against sending Bitcoin to Liquid peg-in addresses before official confirmation of the network’s restoration.
Patched software versions have been distributed to all relevant parties. Federation members are now coordinating to ensure all prerequisites are satisfied before restarting operations.
