- Published on
'Purported White-Hat Hackers' Withdraw $320M in Bitcoin From Liquid
- Authors
- Name
- DeepHorus
A significant security incident occurred on the Liquid Network on Sunday, when approximately 4,000 Bitcoin (BTC), valued at roughly $320 million, was withdrawn from the federation wallet backing the network's Bitcoin-pegged token, L-BTC. The withdrawal paused the network's operations and prompted an urgent investigation by Blockstream, the company that operates the sidechain.
The incident began when a customer sent 4,000 L-BTC to SideSwap, a federation member running a peg-out service, at 14:05 UTC. The coins were burned under a valid authorization, and 23 minutes later, the federation processed a payout of 3,996 BTC. The wallet balance plummeted from approximately 4,200 BTC to about 200 BTC, representing only 5% of its previous holdings.
Blockstream and SideSwap both stated that their respective systems were not compromised. The L-BTC was created without corresponding Bitcoin backing and cashed in through a seemingly ordinary peg-out transaction. This points to a vulnerability in Elements, the open-source software upon which Liquid is built. A fix for the identified bug had been added to the software five weeks prior to the incident.
The party responsible left an on-chain message stating, "we are whitehats. contact us on chain." Blockstream responded within an hour with an email address, initiating a dialogue via PGP-signed Bitcoin transactions. The individual, holding approximately 3,998.5 BTC according to former Blockstream security chief Samson Mow, offered to return most of the funds.
A condition was attached to the return: the bug must be patched first, and every node updated, because the chain remained vulnerable. Blockstream agreed, replying, "Yes, thank you." The two communications were confirmed in the same Bitcoin block.
The characterization of the actors as "white-hat hackers" has been met with skepticism. Ledger CTO Charles Guillemet noted that legitimate white-hat practice typically involves contacting a team before draining a wallet. He suggested the actors' behavior resembled past hacks like Ronin and Euler.
The incident was contained to Bitcoin. Other assets on Liquid, including USDT, DePix, and tokenized real-world assets, were unaffected. The core Bitcoin network itself was not impacted. The situation highlights the persistent security challenges in blockchain interoperability and the critical need for timely software updates across decentralized networks.
