$320 Million in Bitcoin Withdrawn by Alleged White-Hat Hackers from Liquid

Liquid Network Halts Operations After Massive Bitcoin Withdrawal

Liquid Network has temporarily suspended its bridge nodes following a significant withdrawal of approximately 4,000 BTC, valued at around $320 million, from its federation wallet, which supports L-BTC transactions. This incident occurred on Sunday, leading to widespread concern within the cryptocurrency community.

According to SideSwap, a federation member associated with peg-out services, a customer initiated the transfer of 4,000 L-BTC. This transfer was then authenticated and the equivalent amount was withdrawn shortly afterward. Liquid's team has stated that the withdrawal was executed using SideSwap's Peg-out Authorization Key, which they maintain was not compromised. Instead, they attribute the event to a bug within the Elements software that underpins the network.

"We are aware of a security incident involving @Liquid_BTC. Alleged white-hat hackers have withdrawn approximately 4,000 BTC from the Liquid Federation wallet," the Liquid Network tweeted, highlighting ongoing communications with the hackers.

Blockstream, the entity behind Liquid, acknowledged the situation but is yet to disclose specific details regarding the software bug. Interestingly, the withdrawal did not result from a breach of security but rather from a situation where L-BTC was generated without sufficient backing and subsequently converted through a standard peg-out process.

Engagement with Alleged Hackers

The alleged hackers have reached out, claiming to be white hats and requesting to be contacted on-chain. In a response, Blockstream provided an email address, and both parties have since communicated through encrypted messages within Bitcoin transactions. The hackers have expressed a willingness to return most of the withdrawn funds, contingent on a fix for the identified bug to prevent further risk.

Industry experts have offered mixed reactions to the hackers’ claims. Notably, former Blockstream security lead Samson Mow estimated that the hackers currently control about 3,998.5 BTC. Other assets within Liquid, including USDT and tokenized real-world assets, remain unaffected by the incident, ensuring that Bitcoin's primary network has not been compromised.