The Bitcoin sidechain Liquid paused its operations after actors claiming to be white-hat hackers withdrew approximately 4,000 Bitcoin, valued at $320 million, from its federation wallet. The withdrawn funds represented roughly 95% of the wallet's balance of about 4,200 BTC prior to the incident.
Following the event on Sunday, Liquid announced that bridge nodes were disabled to prevent new transactions, while exchanges halted or prepared to halt L-BTC deposits and withdrawals. Liquid confirmed that other assets issued on the network, such as USDT, DePix, and real-world assets, remained unaffected.
Blockstream, the technology provider for Liquid, began contacting the actors through signed onchain messages. According to subsequent messages, the individuals instructed Blockstream to patch the vulnerability and ensure every node was updated before they would return the majority of the Bitcoin. Galaxy Digital research head Alex Thorn noted that the actors also sent encrypted technical details to Blockstream. At the time of the report, the funds had not yet been returned.
SideSwap stated that the withdrawal passed through its peg-out service as a customer order utilizing its Peg-out Authorization Key (PAK), but emphasized that the key was not compromised. According to SideSwap, the L-BTC used in the transaction originated from a bug in Elements, the open-source software that underpins Liquid, rather than from SideSwap's systems.
The sidechain remained paused while federation members worked to resolve the vulnerability.
