Liquid bridge attackers return most of stolen Bitcoin after patch
Security & Exploits ·
Attackers who took $320 million from Liquid Network's bridge have sent back $270 million, leaving roughly 600 BTC still outstanding.
The return followed Blockstream's move to patch the bridge nodes used in the exploit, according to Decrypt. Blockstream then communicated with the actors through an on-chain message, notifying them that the vulnerability had been closed. The bulk of the stolen funds, roughly 3,400 BTC, was subsequently sent back to Liquid Network.
The episode illustrates a pattern seen in some past exploits, where attackers move to return a large share of stolen funds once a project signals that the exploited pathway has been shut and that on-chain movements are being tracked. In this case, the patch to the bridge nodes appears to have preceded the bulk of the returned funds, though the exact sequence of communications and transfers has not been detailed beyond the on-chain message itself.
Not all of the stolen Bitcoin has come back. Close to 600 BTC remains unaccounted for, and it is not clear whether that balance will be returned, held, or moved elsewhere. No information has been provided about the identity of the attackers or whether any law enforcement process is underway.
What triggered the initial breach of the bridge nodes, and how the vulnerability was first discovered, remain unaddressed in the available reporting. It is also unknown whether Blockstream plans further security changes to the Liquid bridge beyond the patch already applied, or whether the outstanding 600 BTC will factor into any future action.