Liquid Network Attacker Returns $270 Million After Blockstream Fixes Bug

An attacker withdrew approximately 4,000 BTC worth $320 million from Blockstream's Liquid Network federation wallet on September 6. The funds were moved using SideSwap's Peg-out Authorization Key, but Blockstream maintains that no private keys were compromised.

The attack exploited a validation bug in Elements, the open-source Bitcoin fork maintained by Blockstream, which underpins the sidechain software used by Liquid Network. A commit posted to the Elements repository on September 1 addressed an issue with dynafed headers, but Blockstream has not confirmed whether this specific commit was the vulnerability exploited.

Following the incident, Blockstream patched the underlying bug and disabled its public bridge nodes within hours. The company agreed to fix the bug before transferring the funds back, and on September 7, it posted a PGP-signed message confirming that the bridge nodes were patched and it was 'safe to return the funds.'

The attacker subsequently returned approximately 3,400 BTC, worth about $270 million at current prices, leaving around 598.5 BTC, worth around $47 million, unaccounted for.