In brief

  • Liquid disabled its bridge nodes on Sunday after about 4,000 BTC left the federation wallet that backs L-BTC.
  • The withdrawal used SideSwap's peg-out key, which Liquid says was not compromised, pointing instead to a bug in Elements.
  • The wallet now holds roughly 200 BTC, around 5% of what it held before.

Blockstream's Liquid sidechain has been paused since Sunday, after about 4,000 BTC worth roughly $320 million left the federation wallet that backs every L-BTC in circulation.

SideSwap, a federation member running a peg-out service, said a customer sent it 4,000 L-BTC at 14:05 UTC. It burned them under a valid authorization, and 23 minutes later the federation paid out 3,996 BTC.

Liquid said the funds moved through SideSwap's Peg-out Authorization Key, but that neither that key nor any other federation key was compromised. SideSwap said none of its systems were breached either, and pointed to a bug in Elements, the software Liquid runs on.

Blockstream has not explained the bug, though a fix for it was added to Liquid's underlying software five weeks earlier. Nothing was forced out of the wallet: someone created L-BTC that no Bitcoin was backing, then cashed it in through a peg-out that looked ordinary.

The wallet held around 4,200 BTC before Sunday and roughly 200 after.

BitcoinBTC · USD

$79,306−0.73%

10:00 AM04:00 PM10:00 PM03:45 AM09:45 AM

$80.4k$80.0k$79.7k$79.3k

24h HighHigh$80,494

24h LowLow$79,081

VolVol$815.7M

Market projectionsOdds by Myriad

Today$78,000 to $80,000$78k–$80k86% chanceThis weekBelow $80,000Below $80k58% chance

Price data by CoinGeckoCoinGeckoMore Bitcoin news and projections →

Talking to the supposed white hats

The hackers offered to send most of the coins back, then attached a condition: patch the bug first, because the chain is still at risk at the latest commit, and update every node. Blockstream's reply, "Yes, thank you," answered the earlier offer, and was confirmed in the same block as the condition.

Myriad: Bitcoin next price move? Click to make your prediction.
Myriad: Bitcoin next price move? Click to make your prediction.

Ledger chief technology officer Charles Guillemet initially argued that "White hats don't drain a bridge and then solicit an "on-chain" contact," likening it to the Ronin and Euler hacks. He briefly allowed they might be people who "intensively played with recent LLMs," then hardened once the condition appeared: white hat practice has "changed," he wrote, adding that, "Now they steal the money and refuse to give back the funds before the vulnerability is fixed..."

Former Blockstream security chief Samson Mow, who published a timeline of the exchange, puts the hackers' address at about 3,998.5 BTC.

Other assets on Liquid, including USDT, DePix and tokenized real-world assets, were untouched, and Bitcoin's own network is unaffected.