Liquid Network confirmed on Sunday (6) a security incident that resulted in the withdrawal of about 4,000 BTC, valued at US$ 320 million, from its federation's wallet. The network suspended new transactions while its operators investigate the flaw and try to recover the funds.
Ver post no X
Those responsible identified themselves as “white hat” hackers, a term used for researchers who exploit vulnerabilities with the intention of helping with the fix. On Monday (7), they said in messages recorded on the Bitcoin blockchain that they intend to return most of the funds, but made the transfer conditional on fixing the flaw that allowed the withdrawal. As of the latest update, the bitcoins remained under the attackers' control.
Blockstream, the developer of the technology used by Liquid, also responded via messages on the blockchain. In one of them, it said that the nodes responsible for the bridge had been fixed and that the funds could be safely returned.
The initial investigation indicates that the problem did not involve the theft of the keys used to authorize withdrawals. According to SideSwap, the platform through which the operation was processed, a user sent 4,000 L-BTC to the bitcoin conversion service at around 14:05 UTC on Sunday. About 23 minutes later, the federation released approximately 3,996 BTC to the indicated address.
SideSwap said Blockstream associated the L-BTC used in the operation with a flaw in Elements, the open-source software that serves as the basis for Liquid. In practice, the assets reached the withdrawal system as if they were legitimate L-BTC and went through the normal redemption process. The platform said its own systems and its authorization key were not compromised. Blockstream has not yet published a complete technical analysis of the cause of the incident.
Liquid works as a sidechain of Bitcoin: users lock BTC and receive L-BTC to move funds within the network, with the expectation that each unit remains backed by bitcoin held by the federation. The incident occurred in this infrastructure and did not compromise the main Bitcoin network.
After detecting the problem, Liquid temporarily disabled its bridge nodes, preventing new transactions from being sent, and asked exchanges to suspend deposits and withdrawals of L-BTC. The company said that other assets issued on the network, such as USDT, DePix and tokenized real-world assets, were not directly affected.
Resuming operations now depends on fixing the vulnerability and resolving the situation of the withdrawn bitcoins. Despite the pledge by those responsible to return most of the value, there was still no public confirmation of the restitution of the funds on Monday.
