Liquid Network Hackers Condition $320M Return on Bug Fix

Liquid Network Hack Extracts $320 Million From Federation Wallet

The individuals who seized roughly $320 million worth of Bitcoin from Blockstream’s Liquid Network have indicated they will return the majority of the funds, but only after the software vulnerability that enabled the breach is fully addressed. The entire negotiation is being conducted transparently through messages embedded directly into Bitcoin transactions.

Blockstream traced the incident to a bug in Elements, the open‑source software that powers Liquid. The stolen Bitcoin moved through SideSwap, an approved trading platform, which failed to differentiate between legitimate and exploit‑derived coins. In response, Liquid paused new transactions while its federation works to patch the vulnerability.

The breach triggered a public, on‑chain dialogue between the fund holders and Blockstream. Described as “purported white‑hat hackers,” the actors claim to be ethical security researchers who exposed the flaw before malicious parties could exploit it. Their stance is that the network must first resolve the underlying issue before any restitution occurs.

What the Liquid Network Hack Messages Show

The two parties have been exchanging tiny “dust” transactions that carry OP_RETURN messages, allowing them to negotiate in full view of the blockchain. The following key blocks illustrate the progression of the dialogue:

• Block 965,822 – A Blockstream‑linked address sends 1,000 satoshis to the hacker’s wallet with the note: “Please contact security@blockstream.com.”
• Block 965,865 – The hacker receives an encrypted message accompanied by a detached PGP signature that matches Blockstream’s published security key, providing cryptographic proof of authenticity.
• Block 965,869 – The hacker replies, sending 1,000 satoshis back to Liquid’s federation peg wallet and asks: “sending most back to the federation address, is that ok.”
• Block 965,875 – Blockstream responds, stating that the vulnerability must be fixed and all nodes patched before any funds can be safely returned.

“Please fix the bug first. The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix,” the message reads.

A Similar Case: Ronin

The episode parallels the 2024 Ronin Bridge incident, where a white‑hat MEV searcher exposed a flaw and withdrew roughly 4,000 ETH and $2 million in USDC—totaling about $12 million at the time. Ronin halted operations, engaged the researcher, and ultimately returned the assets after a brief 80‑minute window, awarding the hacker a $500,000 bounty.

Unlike Ronin’s rapid resolution, the Liquid breach involves a substantially larger sum—approximately 27 times the Ronin amount—and the current holders have conditioned any return on the network’s vulnerability being patched first. Their insistence on a secure fix reflects the heightened risk associated with a $320 million reserve.

What Happens Next in the Liquid Network Hack

The compromise has thrust both Liquid’s $320 million reserve integrity and its software vulnerability onto an urgent timeline. The network remains suspended, and several exchanges have halted L‑BTC deposits and withdrawals pending a full investigation.

The on‑chain negotiation continues in a public, timestamped, and cryptographically verifiable channel, though the identities of the fund custodians stay anonymous. Blockstream and the Liquid federation are focused on deploying the necessary patches to restore confidence and enable the eventual return of the seized assets.

Source link