Liquid Hackers Return 3,400 BTC, Keep $47M as Network Stays Frozen

The instrumentality marks a important crook successful an incident that began Sunday, Sept. 6, erstwhile astir 4,000 BTC, past worthy astir $320 million, near the Liquid Federation wallet backing L-BTC. That represented astir 95% of the reserve, leaving lone astir 197 BTC behind.

3,400 BTC Comes Back, but 598.5 BTC Stays Put

After Blockstream told the actors its span nodes had been patched, and the funds were “safe to return,” they broadcast a transaction sending 3,400 BTC to the federation address. The actors’ code retained 598.49955894 BTC, and thing successful the onchain messages identified that astir 15% remainder arsenic an agreed bounty.

Interestingly, this was not a classical lawsuit of hackers stealing backstage keys and emptying a wallet. Liquid said nary federation keys were compromised, portion Sideswap said its systems were not breached. Instead, the occupation traced backmost to Elements, the Bitcoin Core fork utilized by Liquid nodes.

Elements Bug Opened the Door to Unbacked L-BTC

Independent method reconstructions constituent to a range-proof verification cache bug that seemingly allowed the actors to make L-BTC without the bitcoin usually required to backmost it. In layman’s terms, the strategy accepted bitcoin-like tokens that should ne'er person existed, and those tokens were aboriginal exchanged for existent bitcoin from Liquid’s reserves.

The actors archetypal conducted a 2.5 BTC adust tally earlier astir 4,000 L-BTC reached Sideswap’s peg-out work astatine 14:05 UTC. Sideswap processed the petition normally, burning the L-BTC and requesting payment, and Liquid’s federation sent 3,996 BTC to the destination astatine 14:28 UTC.

There’s a large woody riding connected the distinction. Liquid’s federation signers behaved arsenic designed erstwhile presented with a valid withdrawal request. The nonaccomplishment occurred earlier, erstwhile unbacked L-BTC entered the system, meaning the incidental centered connected issuance alternatively than compromised custody keys.

Blockstream and the Actors Negotiate connected Bitcoin

What followed was thing but a mean information disclosure. The actors communicated publically done Bitcoin OP_RETURN messages, archetypal declaring, “we are whitehats. interaction america connected chain.” Blockstream yet responded with PGP-signed messages, and the actors said they would instrumentality the funds aft the web was patched.

Alongside this, the white-hat statement remains contested. Ledger CTO Charles Guillemet questioned the take-first-and-negotiate-later approach, though helium aboriginal acknowledged the actors could beryllium inexperienced researchers. Liquid itself has cautiously called them “purported white-hat hackers.”

Liquid Stays Frozen arsenic Operators Face the Next Test

The 3,400 BTC return takes a large woody of unit disconnected the reserve problem, but Liquid is not retired of the woods yet. The web remains paused, span nodes are disabled and L-BTC deposits and withdrawals astatine centralized exchanges stay halted. Other Liquid-issued assets, including USDT, Depix, and real-world assets (RWAs), were not touched.

On the different hand, Bitcoin’s main web was unaffected, and Liquid wallets specified arsenic Aqua are disrupted lone for their Liquid functionality. About 598.5 BTC remains nether the actors’ control, with nary published statement explaining whether those funds volition yet return.

A restart whitethorn beryllium successful the cards erstwhile operators tin beryllium morganatic L-BTC is again backed 1:1, administer a patched Elements merchandise crossed the network, and determine it is harmless to reopen the bridge. Until those steps are complete, the particulate has hardly settled connected 1 of Liquid’s biggest method crises.