Blockstream's Liquid sidechain resumed block production Thursday after a four-day halt following a breach of its federation wallet. The restart came after an attacker claiming white-hat status withdrew approximately 4,000 BTC, worth roughly $320 million, and subsequently returned most of the funds.
The incident began Sunday, September 6, when hackers accessed the Liquid Federation wallet and drained about 95% of its approximately 4,200 BTC balance using SideSwap's peg-out authorization key. Blockstream determined the breach resulted from a vulnerability in Elements, the open-source software underlying Liquid, which allowed the creation of invalid L-BTC that could be redeemed as if fully backed.
After Blockstream announced that bridge nodes were patched and safe to receive funds, the attackers returned 3,400 BTC on September 7, valued at approximately $269.2 million at that time. Approximately 598.5 BTC, worth between $46 million and $47 million depending on current pricing, remained in the attacker's possession.
On September 9, the anonymous hacker publicly criticized Blockstream's security spending, stating the company had allocated only $1.5 million to protect $5 billion in assets. The attacker demanded a 10% bug bounty, equivalent to the remaining BTC, threatening that failure to pay would cause users a 15% loss due to the shortfall in reserves backing L-BTC tokens.
Blockstream founder and CEO Adam Back issued a statement reassuring holders that the L-BTC peg would be honored one-for-one, allowing users to redeem tokens for equivalent Bitcoin on the base layer. Back did not specify how the approximately 600 BTC shortfall would be addressed or provide a timeline for reopening peg-in and peg-out services.
The restart proceeded in phases. Initial block production resumed Thursday without transactions as a precautionary measure while the network stabilized. Functionary nodes received required software patches and resumed signing and validating blocks. Peg operations remained disabled while the network rebuilt its BTC-to-L-BTC reserves. Transactions resumed Thursday evening, though peg-out services remained unavailable.
