Liquid Bitcoin Sidechain Halts Operations Following $320M BTC Extraction by Self-Described White Hat Hackers
The Liquid Network suspended its operations following the withdrawal of roughly 4,000 BTC by individuals claiming to be white hat hackers, who have promised to return the bulk of the funds once the security flaw has been addressed.
The Liquid Bitcoin sidechain suspended its operations following the extraction of approximately 4,000 Bitcoin valued at $320 million from its federation wallet by individuals who identified themselves as white-hat hackers.
The Liquid Network announced on Sunday that bridge nodes had been taken offline, which stopped new transactions from being processed, while cryptocurrency exchanges either suspended or were in the process of suspending L-BTC deposit and withdrawal functionality.
Blockstream, which serves as Liquid's technology provider, initiated communication with the individuals responsible through cryptographically signed onchain messages. Follow-up communications revealed that the actors instructed Blockstream to address the vulnerability and verify that every node had been upgraded before they would return the majority of the Bitcoin.
According to Galaxy Digital research head Alex Thorn, they additionally transmitted encrypted technical information to Blockstream. As of this writing, the extracted funds had not yet been returned.
SideSwap reported that the extraction was processed through its peg-out service as what appeared to be a standard customer order utilizing its Peg-out Authorization Key (PAK), though the company emphasized that the key itself was not compromised. The company stated that the L-BTC involved in the transaction came from a vulnerability in Elements, the open-source software that powers Liquid, and not from SideSwap's own systems.
Cointelegraph reached out to Liquid Network and Blockstream for comment.
The extracted Bitcoin accounted for approximately 95% of the wallet's total balance of around 4,200 BTC prior to the security incident. Liquid confirmed that other digital assets issued on the network, including USDT, DePix and real-world assets, were not impacted. The sidechain continued to remain suspended while federation members collaborated to address and resolve the vulnerability.
This is a developing story, and further information will be added as it becomes available.