White‑Hat Hackers Drain Over 4,000 BTC from Blockstream’s Liquid Network Treasury

The Liquid Network announced on Sunday that alleged white‑hat hackers withdrew roughly 4,000 BTC—about $320 million—from the federation wallet that backs L‑BTC. Bridge nodes were taken offline and the sidechain was paused, while other assets such as USDT, DePix and various RWAs remained unaffected, according to the project’s official X account.

The Liquid Network is a federated Bitcoin sidechain created by Adam Back’s Blockstream. It issues several assets, including LBTC, which is backed by BTC held on the main chain in a multisig wallet shared by 15 corporate participants. Moving funds requires signatures from at least 11 of those members. Prior to the incident, the treasury held more than 4,200 BTC; after the breach, Blockstream’s proof‑of‑reserves page shows just over 207 BTC remaining.

The attackers removed 4,019.4 BTC from the reserve address via a peg‑out transaction that used the SideSwap Peg‑out Authorization Key. SideSwap is a bridge exchange and a member of the Liquid Federation. Although the exact method remains unconfirmed, it appears the hackers exploited an inflation bug on the LBTC sidechain to mint more than 4,000 LBTC out of thin air and then redeem them for native bitcoin from the federation. Because the transaction looked valid under the flawed consensus, the federation members’ HSM security devices signed the withdrawal, which was valued at about $320 million at the time.

The hacker transferred the funds to an address ending in 6gyqjlte and immediately broadcast a follow‑up transaction containing an OP_RETURN message that read, “we are whitehats. contact us on chain.” At the time of writing, the coins remained at that address.

A minor main‑chain transaction to the hacker’s address included an OP_RETURN note requesting contact at an obscured email address (likely a Blockstream public address, though unconfirmed). A subsequent OP_RETURN spend from the same address requested contact via Signal at @m671aw.70. Since these spends used an output from the address holding the stolen 4,000 BTC, they must have originated from the hacker.

Following the breach, exchanges were instructed to halt L‑BTC deposits and withdrawals. Bridge nodes on the Liquid Network have been paused, restricting access to the sidechain while it continues to generate blocks.

JAN3 CEO Samson Mow noted that Aqua’s Liquid functionality was disrupted, although on‑chain bitcoin transactions remained operational. Other wallets that rely on the Liquid Network are likely to experience similar impacts. Users holding LBTC currently face exposure because the underlying bitcoin cannot be redeemed. Due to the private nature of the chain, detailed on‑chain analytics are limited, making it unclear how much LBTC is held by retail participants versus Blockstream‑affiliated entities. If the funds are not restored, the incident could severely damage the Liquid Network’s user community.

LBTC holders have limited recourse and must await any dialogue with the hackers for a resolution. Given the scale of the theft, it would be challenging—though not impossible—for the attackers to abscond with the entire sum. A possible outcome is that the hackers demand a finder’s fee and return most of the funds.

Source link