Liquid sidechain hack recovers 3,400 of 4,000 BTC stolen, but $47M remains missing as Blockstream negotiates with purported white hat actors.
Security & Exploits ·
Decrypt reported that Blockstream is negotiating with individuals who exploited Liquid's sidechain to recover approximately 598.5 BTC still outstanding. The attackers withdrew roughly 4,000 BTC on Sunday, then returned 3,400 on Monday, leaving around 600 BTC valued at $47 million unresolved. At the time of the breach, the responsible parties claimed to be white-hat security researchers, though skeptics including Ledger's Chief Technology Officer questioned whether retention of the remaining funds constituted a legitimate bounty or extortion.
A flaw in Liquid's underlying Elements software enabled the creation of unbacked L-BTC tokens that were subsequently exchanged for reserve Bitcoin through SideSwap, a Liquid Federation member. The vulnerability existed at the transaction validation stage, causing both SideSwap's node and Liquid's distributed functionary nodes to accept the counterfeit tokens as legitimate before processing withdrawals. Liquid emphasized that no private keys were compromised and the federation's mechanisms operated as designed.
Blockstream has prepared an emergency patch currently undergoing review, with additional fixes deployed to bridge nodes already in place. The timeline for restoring full network operations and correcting the ledger state remains unspecified, though Liquid stated that recovering the outstanding funds and resuming normal transaction processing represent immediate priorities.