The parties who withdrew roughly 4,000 BTC from Liquid Network’s federation wallet returned 3,400 BTC, worth about $270 million, on Monday, restoring about 85% of what left the Bitcoin sidechain. They have retained 598.5 BTC, worth roughly $47 million.

The incident, which led to the freezing of the sidechain on Sunday, saw 4,000 L-BTC sent to the peg-out service run by settlement platform SideSwap at 14:05 UTC. The tokens were burned against a valid peg-out authorization and the Liquid Federation paid out roughly 4,000 BTC to a Bitcoin address 23 minutes later. SideSwap said the L-BTC in that order had been created by a bug in Elements, the open-source software Liquid runs on, and that neither its systems nor its Peg-out Authorization Key were compromised. The federation wallet held roughly 4,200 BTC beforehand, so the withdrawal took about 95% of all bitcoin pegged into the network.

This story is an excerpt from the Unchained Daily newsletter.

Subscribe here to get these updates in your email for free

In short, the federation paid out real bitcoin against L-BTC that should never have existed.

The group, which called itself a white hat, sent PGP-encrypted vulnerability details and set a condition: fix the bug and “make sure every node is patched.” Blockstream answered with a PGP-signed message saying bridge nodes were patched and the funds were safe to return, and 3,400 BTC landed at the federation address.

Ledger Chief Technology Officer Charles Guillemet has, meanwhile, rejected the white hat label. He said that if the roughly 600 BTC still held was a reward negotiated through encrypted onchain messages, the arrangement looked more like extortion than white-hat hacking. Neither Blockstream nor Liquid has described the outstanding coins as a bounty or disclosed any terms.

Liquid has not resumed. Blockstream said updated software has been deployed and federation members are preparing a coordinated restart. JAN3 CEO and former Blockstream executive Samson Mow said further fixes and security work were under way, that a chain split had to be resolved, and that users should not send bitcoin to Liquid peg-in addresses until the restart is confirmed. Other assets issued on Liquid, including USDT, DePix and tokenized real-world assets, were unaffected.

AI-assisted content: This article was produced with the assistance of AI tools and was reviewed, edited, and fact-checked by a member of the Unchained editorial team before publication.

Liquid Attackers Return 3,400 BTC and Keep Nearly 600 as Blockstream Prepares a Restart

Stay Ahead in Crypto