Liquid Network Hackers Return 3,400 BTC Worth $263 Million
The pledge to return the lion’s share of the stolen bitcoin proved no mere bluff. The unknown parties who style themselves “white hats” sent 3,400 BTC, worth roughly $263 million, back to the Liquid Network after Blockstream reported that the flaw had been fixed.
How the Attack Unfolded
In total, the attackers siphoned around 4,000 BTC from Liquid’s federation wallet, worth approximately $320 million at the time. Since the wallet held about 4,200 BTC, the intruders effectively commanded 95% of the network’s Bitcoin reserve across just a handful of operations.
From the outset, however, the perpetrators insisted they had no intention of claiming the entire stash. Through messages inscribed on the blockchain, they first demanded that the vulnerability be patched and every node updated, since the network remained imperiled. Blockstream later dispatched a signed message confirming that the bridge nodes were repaired and the funds could be safely returned.
The Return of the Funds
Once the fixes were verified, the unknown parties transferred exactly 3,400 BTC back to the federation wallet address. The transaction left roughly 598.5 BTC at an address tied to the attack, valued at about $47 million at the time of publication. No public agreement permitting them to keep such a sum as a reward has yet come to light.
Consequently, the label “white hats” must still be applied with a caveat. Returning roughly 85% of the funds affirms their stated intentions more convincingly than any blockchain message could, yet the fate of the remaining tens of millions of dollars remains uncertain.
Not a Bitcoin Compromise
The attack itself had nothing to do with any compromise of Bitcoin. The funds were extracted through Liquid’s mechanism, which binds L-BTC to genuine bitcoins held in the federation wallet. SideSwap had earlier stated that its Peg-out Authorization Key was not stolen, and that the problematic L-BTC arose from a flaw in the Elements software foundation.
Following the incident, Liquid halted its bridge nodes, while exchanges suspended L-BTC deposits and withdrawals. Other network assets, including USDT, DePix, and tokenized real-world assets, were not directly affected, according to the project. The network stayed offline while Blockstream and federation members applied additional fixes, untangled a chain split, and prepared a safe restart.
Where Things Stand
The recovery amounted to 3,400 BTC. Around 598 BTC still rest with the attackers, and Blockstream continues its dialogue with them.
A day earlier, the picture had looked far more alarming. After the $320 million withdrawal, Liquid was forced to halt the sidechain, and the promise of the unknown parties to return the money remained merely a message on the blockchain. Now a substantial portion of the reserve has genuinely returned to its owners.
A Familiar Pattern
Similar logic involving the creation of unbacked assets has already caused trouble in other blockchain bridges. In the spring, an attacker minted a billion tokens through a Hyperbridge vulnerability, transforming a flaw in cross-chain operation validation into an opportunity to conjure assets from thin air.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
