Liquid Network Loses About $320 Million in Bitcoin to Self-Described White-Hat Hackers

According to the on-chain message, the attackers asked Liquid to patch the underlying vulnerability before the funds are returned. Tom's Hardware quoted the message as saying: "Please fix the bug first. The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix." Liquid responded on-chain with its security team's contact and reportedly moved communications to an encrypted channel.

BitKE reported that the incident did not involve a compromised private key. Instead, the funds moved through SideSwap, an authorised platform used to facilitate transactions on Liquid. Blockstream attributed the exploit to a software bug in Elements, the open-source technology that underpins Liquid. SideSwap said it could not tell bitcoin created through the bug apart from legitimate funds and therefore treated both the same way.

Launched in 2018, Liquid lets users lock BTC on the Bitcoin main chain in exchange for an equivalent token, L-BTC, and is overseen by a federation of more than 80 exchanges, infrastructure firms, and asset managers. The network said it is working to restore normal operations and has warned of service disruptions. It has not said when transactions will resume or whether the withdrawn bitcoin will be returned.

Binance says it reserved its own funds to cover a $6.3 billion hack, while stablecoin issuers froze billions. Experts question whether victims will recover the losses.