- Purported white-hat hackers withdrew roughly 4,000 BTC, worth about $320 million, from Liquid’s federation wallet on Sept. 6.
- The outflow represented about 95% of Liquid’s reported bitcoin reserves of approximately 4,200 BTC.
- SideSwap processed a peg-out of 3,996 BTC after 4,000 L-BTC were burned; Blockstream attributed the L-BTC to an Elements software bug.
- Liquid disabled bridge nodes and told exchanges to pause L-BTC deposits and withdrawals. USDT, DePix and RWAs were unaffected.
- The holders said they would return most of the bitcoin after every node is patched; funds had not been returned as of early Sept. 7.
The Liquid Network said Sunday that purported white-hat hackers withdrew approximately 4,000 bitcoin, worth about $320 million, from its federation wallet, prompting the Bitcoin sidechain to pause activity.
In a Sept. 6 post on X, Liquid said Blockstream was working to contact the parties through an onchain signed message. The network said the funds left via the SideSwap Peg-out Authorization Key, but that key was not compromised, nor were any others.
The withdrawal represented roughly 95% of Liquid’s reported bitcoin reserves, which stood at about 4,200 BTC before the incident, according to CoinDesk. Liquid, launched in 2018 by Blockstream and overseen by a federation of more than 80 exchanges, infrastructure firms and asset managers, issues L-BTC against bitcoin locked in the federation wallet so trades can settle faster than on Bitcoin’s base layer.
SideSwap said a customer sent 4,000 L-BTC to its peg-out service at 14:05 UTC. The service burned the L-BTC under a valid peg-out authorization, and at 14:28 UTC the federation paid 3,996 BTC to the customer’s bitcoin address. SideSwap said Blockstream later established that the L-BTC was created through a bug in the Elements software that underpins Liquid, not through a compromise of SideSwap’s systems.
An onchain message from the receiving address read: “we are whitehats. contact us on chain.” Subsequent OP_RETURN messages compiled by Galaxy Digital’s Alex Thorn said the holders would return most of the funds after the vulnerability was fixed and every node installed the patch. One message stated: “Please fix the bug first. The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix.”
Ledger CTO Charles Guillemet questioned the white-hat claim, writing that white hats do not drain a bridge and then solicit onchain contact. Liquid disabled bridge nodes so no new transactions can be submitted and notified exchanges to pause L-BTC deposits and withdrawals. Other assets on Liquid, including USDT, DePix and real-world assets, were unaffected. As of early Monday, the bitcoin had not been returned.
