A hacker who withdrew roughly 4,000 bitcoins from Liquid Network has returned about 3,400 BTC after demanding that a software bug be fixed, leaving nearly 600 BTC worth about $47 million under their control. The incident, valued at roughly $320 million to $340 million depending on bitcoin prices, ranks among the largest cryptocurrency thefts reported this year.
Liquid, a Bitcoin-based settlement network launched in 2018 by Blockstream, disclosed the incident on Sunday. It described those responsible as purported “white-hat” hackers and paused network operations while the issue was investigated.
The funds were withdrawn from the Liquid Federation wallet, which held about 4,200 BTC before the incident. Liquid said the withdrawal went through SideSwap’s Peg-out Authorization Key, although that key itself was not compromised.
Hackers Demanded a Fix Before Returning Funds
Reports indicate that the attackers exploited a bug in Elements, the software underlying Liquid, to create L-BTC that was then used for the withdrawal. The hackers communicated through messages recorded on the Bitcoin blockchain and said they would return the funds once the vulnerability had been fixed across the network.
Blockstream subsequently told the hackers through a signed on-chain message that its bridge nodes had been patched. Former Blockstream executive Samson Mow said on Monday that around 3,400 BTC had then been returned.
Approximately 598.5 BTC remained with the hacker, worth about $47 million at the time. The identity of the person or group behind the incident remains unknown.
Liquid Remains Paused During Security Work
Liquid has kept the network paused while additional security work is completed. Exchanges were also notified to suspend deposits and withdrawals involving L-BTC until operations resume.
The network uses a federation of operators to hold bitcoin that backs L-BTC on a one-to-one basis. Liquid’s technical documentation explains that federation members operate the infrastructure responsible for securing bitcoin held by the network and processing withdrawals back to Bitcoin.
Mow said Liquid would remain offline until further fixes and security improvements were completed. Other assets issued on Liquid were not affected by the incident, according to the network.
The theft also places the incident high on the Rekt leaderboard, which tracks major cryptocurrency losses and exploits.
Featured image credits: Wikimedia Commons
For more stories like it, click the +Follow button at the top of this page to follow us.