Liquid Network Hacked for $320M as Blockstream Faces Ransom Demands
The Liquid Network, a Bitcoin sidechain used for fast settlement between exchanges and traders, has been hacked. On September 6, an exploit drained nearly 4,000 BTC from its federation wallet, worth about $320 million at the time.
The attackers returned 3,400 BTC the next day, but left behind 598.5 BTC as change, which is roughly $47 million in value.
The hack was caused by a consensus bug in Elements, the open-source software that powers Liquid, not from a stolen SideSwap key. The party created about 4,000 L-BTC with no bitcoin deposit behind it and sent them to SideSwap's peg-out service, where the tokens were burned on Liquid.
The attackers called themselves white hats in an OP_RETURN message on Bitcoin and demanded that Blockstream fix the bug before returning funds. Blockstream released an emergency Elements update, which addressed a proof-verification cache vulnerability by hardening the cache keys used for range proofs.