This article was compiled and organized by BlockWeeks
Event Overview
Liquid Network is a Bitcoin sidechain that recently had 4000 BTC (approximately $320 million) stolen by a hacker claiming to be a "white hat," but the attacker only returned 85% of the funds.
The Theft Method
On Sunday, the hacker stole 4000 BTC from the Liquid federation (the entity responsible for sidechain block production and peg-in/peg-out). The attacker exploited a vulnerability in the sidechain node code to artificially generate 4000 L‑BTC (Liquid's version of wrapped Bitcoin), and then transferred the funds to the mainchain through SideSwap's automatic forwarding service. Although withdrawal addresses need to be whitelisted, SideSwap's automatic forwarding mechanism allows any entity to first transfer funds to its whitelisted address, and then automatically forward them to the withdrawal requester, thereby bypassing the restriction.
On-Chain Communication and Negotiation
The attacker consolidated the funds into a single address and wrote "We are white hats, please contact us on-chain" in the OP_RETURN field. Blockstream, the primary developer of the Liquid codebase, then began communicating with the hacker through OP_RETURN. After several rounds of interaction, the hacker returned 3400 BTC (85%). Both parties used encrypted messages; Blockstream encrypted with the hacker's Bitcoin address, and the hacker encrypted replies with Blockstream's publicly available PGP key. As of midweek, the remaining 15% (600 BTC) was still stranded in the hacker's address, and negotiations appeared to have broken down. On September 9, the hacker sent a plaintext message to Blockstream, accusing it of "negligence" and demanding a 10% bounty (approximately 3400 BTC, worth about $26 million), otherwise it would keep the remaining 15% of the funds and threatened to publicly disclose the decrypted private key. Over four days, the two parties sent a total of 28 messages. In addition, the hacker's address also received a large number of other messages, including requests to return the funds, offers of legal representation, memecoin advertisements, etc. The number of OP_RETURN emails it received in a single day exceeded the amount received by Satoshi Nakamoto's genesis block over ten years.
The Controversy Over White Hat Behavior
The attacker claims to be a white hat, but a true white hat should responsibly disclose the vulnerability to developers rather than carry out theft first and then negotiate its return. Only in cases where a black hat might steal first is it reasonable to actively attack and then return the funds. This vulnerability could have been reported directly to Blockstream and patched, unlike the Coldcard vulnerability, which cannot be fixed remotely. A true white hat has already announced that they can "steal" 50 BTC from Coldcard users and has placed the assets in a Wyoming trust, planning to return all the funds. However, this attacker is withholding 15% of the funds as a bargaining chip, which is essentially extortion, not white hat behavior.
Industry Impact
The Liquid incident is not an event with systemic implications for the Bitcoin ecosystem, but it is the latest in a series of recent high-profile BTC thefts (including Coldcard, BTCPay Server, etc.). These incidents show that the Bitcoin community is facing network theft problems similar to those of other more expressive blockchains (such as Ethereum and Solana). The simplicity of Bitcoin's code language and its limited programmability have historically limited its on-chain attack surface, but recent incidents show that security risks are rising. There is widespread speculation that the attacker may have used AI to identify and exploit the vulnerability. As the "clanker wars" continue, the urgency of hardening the codebases of Bitcoin and the entire crypto space is increasing.
