Unknown perpetrators withdrew about 4,000 BTC, valued at $320 million, from the Liquid Federation wallet on September 6, in a breach that removed about 95% of the wallet’s balance and forced the network to halt transfers between Liquid and Bitcoin.
The attackers described themselves as white-hat ethical hackers in a message embedded on the Bitcoin blockchain. Using Bitcoin’s OP_RETURN field, they wrote: 'we are white hats. Contact us on the blockchain'. They also promised to return 'most' of the 4,000 BTC once the vulnerability is fixed. Their identities, the vulnerability they found and whether the funds will be returned remain unknown.
Liquid Network confirmed that alleged ethical hackers had withdrawn about 4000 BTC from the federation’s wallet. Two transactions moved about 3998.5 bitcoins. The wallet had held nearly 4200 BTC before the incident and its balance fell to around 207 BTC afterwards.
Liquid is a sidechain intended to speed up transactions while allowing the issue of bitcoin-backed assets. Its federation wallet is central to transfers between Liquid and Bitcoin. The wallet relies on a multi-signature arrangement requiring agreement from 11 members out of 15, a structure intended to prevent any one participant from authorising a transfer alone.
The withdrawals used SideSwap’s PAK, or Peg-out Authorization Key. Liquid said SideSwap’s PAK itself had not been compromised. The precise weakness that enabled the transfers has not been disclosed, and it remains unclear whether federation members’ keys or systems were compromised, bypassed or affected in some other way. The exact cause of the multi-signature security failure is also unknown.
In response, Liquid disabled nodes responsible for transfers between Liquid and Bitcoin. Several exchanges suspended deposits and withdrawals of L-BTC, the asset used on the network. These measures stopped further peg-outs while the network addressed the incident.
Early analyses found the withdrawn funds concentrated at an identifiable address, rather than spread across a large number of wallets. That may make the movement of the bitcoin easier to follow on the public blockchain, although it does not establish who controls the address or whether the funds will be returned.
Blockstream, which attempted to contact the authors of the withdrawal through a signed message on the blockchain, has not identified the people behind the claim. The episode leaves Liquid facing a difficult test of a system designed around shared approval: a wallet protected by an 11-of-15 multi-signature process was drained almost entirely, while those responsible say they acted to expose a flaw rather than to keep the money.
Comments (0)