Unknown hackers have stolen approximately 4,000 BTC ($320 million) from the Liquid Network sidechain federation wallet, representing about 95% of all Bitcoin reserves on the network, which is developed by Blockstream and whose infrastructure is used by crypto exchanges and financial institutions.
Unknown hackers have stolen approximately 4,000 BTC ($320 million) from the Liquid Network sidechain federation wallet, representing about 95% of all Bitcoin reserves on the network, which is developed by Blockstream and whose infrastructure is used by crypto exchanges and financial institutions.
After detecting an anomalous transaction, the developers temporarily disabled the bridge nodes, halting the sidechain, and called on exchanges to suspend deposits and withdrawals of L-BTC tokens, The Register reports .
For their part, the attackers immediately announced their motives for their actions. In a message encrypted directly in the Bitcoin transaction, they called themselves “white hat hackers” and urged developers to get in touch. The Blockstream team quickly responded with an on-chain message, after which the parties switched to communicating in encrypted channels.
According to available information, the hackers promised to return "most" of the withdrawn funds, but only after the developers completely fix the vulnerability and update all network nodes.
“Please fix the bug first. In the current version, the network is at risk. Make sure every node is updated. After confirming the fix, we will safely transfer the money back,” the hackers’ on-chain appeal reads.
The details of how the attackers managed to empty the federation’s wallet are still under investigation. The funds were withdrawn via the SideSwap platform using a Peg-out Authorization Key (PAK). Liquid emphasizes that neither the SideSwap key nor other authorization keys were hacked or compromised.
According to preliminary data from analysts, the cause could be a consensus vulnerability in the Elements software, which underlies the sidechain. This allowed the generation of invalid L-BTC tokens without real collateral, and then exchanging them for real Bitcoin from reserves using the standard peg-out mechanism via SideSwap.
Other assets issued on the Liquid network — including stablecoins (USDT) and tokenized real assets (RWA) — are not affected. The main Bitcoin network also remains completely secure.
Currently, 4,000 BTC remain at the hackers' address, and the entire crypto community is waiting to see if the white hats' promise will come true.
