Blockstream is in ongoing negotiations with individuals who exploited the Liquid Network to recover approximately 598.5 BTC still outstanding from the breach, according to an incident report from Liquid Network on Tuesday.
A flaw in Liquid's underlying Elements software allowed the creation of unbacked L-BTC tokens that were exchanged for reserve Bitcoin. The hackers withdrew approximately 4,000 BTC on Sunday and returned 3,400 BTC on Monday, leaving about 600 BTC valued at roughly $47 million unrecovered.
How the exploit occurred
After stealing the tokens, the individuals exchanged the Bitcoin through SideSwap, a Liquid Federation member operating a withdrawal service. The software's transaction validation checks accepted the unbacked tokens as valid before the withdrawal began.
"Because the validation failure occurred at the transaction level before the peg-out was initiated, both SideSwap's node and the Liquid Network's globally distributed functionary nodes accepted the LBTC as valid," Liquid developers said.
Liquid's reserve fell from approximately 4,205 BTC to 197 BTC after the withdrawal and other processed transactions before operations halted. USDT and other Liquid-issued tokens were unaffected by the vulnerability.
Recovery efforts and skepticism
Liquid said that the Liquid Federation functionaries were not hacked and no private keys were compromised. The peg-out mechanism that authorizes withdrawals to whitelisted addresses operated as designed.
The individuals identified themselves as white-hat security researchers in a message on Bitcoin's blockchain. However, some remained skeptical of the white-hat designation after most funds were returned but 600 BTC remained unreturned.
Blockstream is preparing an emergency update following a patch to bridge nodes on Monday. Once finalized, network operators will make further adjustments to restore operations and correct the network's state. Liquid did not disclose the terms of negotiations with the hackers or provide a timeline for fund recovery.
