A major withdrawal of 4,000 BTC from Liquid Network raised security concerns, identified as a flaw exploited by hackers claiming to be "white hats."
On September 6, a significant withdrawal of approximately 4,000 BTC, valued around $320 million, occurred from the Liquid Network's federation wallet. This incident has raised alarms within the cryptocurrency community.
In a statement, the Liquid Network team acknowledged the security issue, stating that individuals identifying as "white hat hackers" were responsible for the withdrawal. Their communication indicated a willingness to return the funds once a vulnerability was addressed.
The hackers left behind a message, asserting their intention to communicate through the blockchain and noted, "After confirming the fix, we will return the money." According to Alex Thorn, a research head at Galaxy, the hackers have been in discussions with Blockstream for further coordination.
Thorn commented that the hackers have been using OP_RETURN messages and PGP encrypted text to communicate with Blockstream.
In reaction to the breach, developers promptly disabled bridge nodes and paused new transactions, advising exchanges to halt L-BTC deposits and withdrawals. Fortunately, other assets on the network, including USDT and DePix, remained unaffected.
Exploitation Details
The attackers exploited a flaw in the Liquid software that allowed them to generate L-BTC tokens without sufficient Bitcoin reserves. They then successfully traded these tokens for Bitcoin using the SideSwap service. Normally, transactions on the Liquid Network require users to lock up Bitcoin to receive equivalent L-BTC; however, in this case, the protocol was compromised.
SideSwap processed the request made by the attackers to exchange 4,000 L-BTC, not recognizing the invalidity of the tokens and transferring almost 4,000 BTC to the hackers' wallet instead.
SideSwap clarified that its systems were not breached, asserting that the attackers did not compromise any keys or access their systems.
Researcher OrangeSurf speculated the incident might stem from an inadequacy in the cryptographic checks necessary for transaction validation, suggesting a caching issue led to the approval of invalid transactions.
Fix in Progress
Interestingly, a fix for the identified vulnerability had been in development prior to the attack, with changes already present in the Elements repository as of early September. However, the patch had not yet been deployed, raising questions about the management of software updates among those with withdrawal privileges.
Despite the unpatched software being in use, some nodes were able to reject the flawed transactions, indicating a failure in the overall security framework during this incident.
