Liquid Network Hacked for $320M as White-Hat Attacker Negotiates Return

The Liquid Network, a Bitcoin sidechain used by exchanges to move funds behind the scenes, was hacked on September 6, resulting in a loss of approximately $320 million worth of BTC. The attack exploited a bug in the Elements software that underpins the Liquid sidechain, allowing an attacker to generate L-BTC that was never backed by real Bitcoin and then use those unbacked tokens to trigger a peg-out transaction.

The attacker withdrew roughly 4,000 of the approximately 4,200 BTC held in the Liquid federation's wallet. However, instead of attempting to launder or hide the funds, the attacker began communicating with Blockstream directly through messages embedded in Bitcoin transactions, stating that they would return the bulk of the funds once the underlying vulnerability was fixed and every node in the federation had applied the patch.

Blockstream worked quickly to patch the bridge nodes and signal that the fix was live. Within a day of the initial withdrawal, a large share of the funds started moving back to Liquid's federation address. The attacker returned approximately 3,400 BTC, worth roughly $268 million at the time of transfer, while keeping about 598.5 BTC, worth close to $47 million, for themselves.