Liquid Network Loses 4,000 Bitcoin in Alleged White-Hat Hack

The Liquid Network announced on Sunday that alleged white-hat hackers had removed approximately 4,000 bitcoin, valued at roughly $320 million, from the federation wallet backing L-BTC. Bridge nodes were taken offline and the sidechain halted. Other assets issued on the network, such as USDT, DePix and RWAs, were not impacted, according to a post on X from the official account.

The Liquid Network operates as a federated Bitcoin sidechain created by Adam Back's Blockstream. The Liquid chain mints several asset types including LBTC, which is backed by BTC held on the Bitcoin main chain in a multi-signature wallet requiring 15 corporate and known participants. To move funds out of the treasury, 11 out of 15 members must approve a valid multisig transaction. Prior to the incident, the treasury contained more than 4,200 BTC; Blockstream's proof-of-reserves page now indicates just over 207 BTC remaining.

The attackers removed 4,019.4 BTC from the reserve address via a peg-out transaction that utilized the SideSwap Peg-out Authorization Key. SideSwap functions as a bridge exchange and is a member of the Liquid Federation. Although the exact method of the exploit remains unconfirmed, it appears that an inflation bug on the LBTC sidechain allowed the hackers to generate over 4,000 LBTC that had not previously existed and then exchange them for on-chain bitcoin from the federation. Since the transaction appeared legitimate due to the consensus flaw, the HSM security servers of the federation members authorized the withdrawal, worth approximately $320 million at the time.

The hacker transferred the bitcoin to an address concluding with 6gyqjlte. From that address, they soon signed another transaction embedding a message in the OP_RETURN field: “we are whitehats. contact us on chain.” As of the time of this report, those coins remained at that address.

A minor mainnet transaction was sent to the hacker's address, accompanied by an OP_RETURN message reading “Please contact security@blockstream.com”, likely originating from a Blockstream public address, though this has not been confirmed. Subsequently, another OP_RETURN spend from the hacker's address contained “Please contact us on Signal @m671aw.70.” Since this transaction uses an input from the address that holds the 4,000 BTC, the message definitively comes from the hacker.

In reaction to the security incident, exchanges were instructed to halt L-BTC deposits and withdrawals. Bridge nodes on the Liquid Network have been suspended, restricting access to the sidechain, which is still producing blocks.

Samson Mow, CEO of JAN3, stated that Aqua's Liquid features were impacted but on-chain bitcoin continued to function normally. Other wallets in the industry relying on the Liquid Network are likely to be affected. Users who hold LBTC effectively face risk to their savings because the underlying BTC is currently not redeemable. Due to the private nature of the Liquid chain, on-chain analytics for users are limited, and there is little public information about how much LBTC is held by retail clients versus Blockstream's own entities. However, if the funds are not returned, it would be a serious setback for the Liquid Network's user base.

LBTC holders have few options other than to wait for negotiations with the hackers to conclude. Considering the scale of the theft, it would be challenging for the hackers to successfully abscond with all the bitcoin, though it is not entirely impossible. A likely outcome is that the hackers demand a bounty and return most of the funds.