Key Points
- Self-described whitehat attackers gave back 3,400 out of 4,000 Bitcoin taken from Liquid Network’s federation reserve on Sunday
- Approximately 598 BTC, valued at around $47 million, remains in hacker possession
- The breach depleted nearly Liquid’s entire 4,200 BTC reserve, leaving L-BTC severely undercollateralized
- Negotiations between Blockstream and attackers occurred through cryptographically signed messages in Bitcoin transactions
- Liquid operations remain suspended as security patches are implemented and network restart protocols are finalized
Blockstream’s Liquid Network, a Bitcoin layer-2 sidechain solution, suffered a major security incident on Sunday when threat actors extracted approximately 4,000 Bitcoin from its federation reserve wallet. This wallet provides the backing collateral for L-BTC, Liquid’s wrapped Bitcoin asset, maintaining a 1:1 peg ratio.
Following the exploit, the reserve contained merely 197 BTC from its original balance of approximately 4,200 BTC. This dramatic depletion immediately undermined the full collateralization of L-BTC tokens in circulation.
Network operators implemented emergency protocols swiftly. They shut down bridge node functionality, halted all network operations, and coordinated with cryptocurrency exchanges to suspend L-BTC deposit and withdrawal capabilities. Liquid’s other digital assets, such as tether, remained unaffected by the incident.
The perpetrators claimed whitehat status. Their communication indicated they would release the stolen assets after vulnerability remediation was complete and all network nodes had implemented security updates.
Blockstream initiated communication by encoding cryptographically signed messages within Bitcoin blockchain transactions. Both parties conducted negotiations publicly through on-chain messages.
Majority of Stolen Bitcoin Returned
Following Blockstream’s verification that bridge nodes received necessary security patches, the hacker group transferred 3,400 Bitcoin back into the federation reserve. This constitutes approximately 85% of the total amount extracted.
Former Blockstream executive and current JAN3 CEO Samson Mow verified the return on Monday. He indicated that about 598 BTC remains unaccounted for and that discussions with the group are ongoing.
Based on current Bitcoin valuations, the recovered funds total roughly $270 million. The 598 BTC still controlled by the attackers represents approximately $47 million in value.
The initial fund extraction was executed via SideSwap’s Peg-out Authorization Key mechanism. Representatives from both Liquid and SideSwap clarified that the authorization key itself wasn’t breached.
According to SideSwap’s analysis, the security flaw originated from a defect in Elements, the open-source blockchain framework powering Liquid Network.
Debate Surrounding Whitehat Classification
The whitehat designation has sparked controversy within the cryptocurrency security community. Charles Guillemet, chief technology officer at Ledger, expressed skepticism following the partial fund return.
Guillemet suggested that if the unreturned 600 BTC constitutes a negotiated compensation package, the situation resembles extortion rather than responsible vulnerability disclosure.
Blockstream hasn’t officially characterized the outstanding Bitcoin as a bug bounty payment. The organization also hasn’t revealed any specific terms regarding fund repatriation.
As of Monday, the network continues to operate in suspended mode. Blockstream and federation participants are implementing comprehensive security enhancements, addressing a blockchain fork issue, and organizing protocols for synchronized network reactivation.
Mow advised that users need not take any immediate actions. He emphasized caution, urging users to refrain from transmitting Bitcoin to Liquid peg-in addresses until official network restoration is announced.
Patched software versions have been distributed to all relevant parties. Federation members are finalizing preparations for a synchronized restart pending fulfillment of all security requirements.
Get 3 Free Stock Ebooks
Discover top-performing stocks in AI, Crypto, and Technology with expert analysis.
- Top 10 AI Stocks - Leading AI companies
- Top 10 Crypto Stocks - Blockchain leaders
- Top 10 Tech Stocks - Tech giants
