Liquid Network Hacker Returns 3,400 Bitcoin After Exploit

The Liquid Network has recovered most of the Bitcoin drained during a recent exploit. On September 6, an attack was disclosed that did not involve stolen private keys and reportedly originated in Elements, the Bitcoin Core fork used by Liquid. A vulnerability in the range-proof verification cache allowed for the creation of unbacked tokens, which were then used to obtain real Bitcoin from Liquid's reserves.

The hacker, who claimed to be a white-hat hacker, initially stole 4,000 BTC but returned 3,400 on Monday. The remaining 600 BTC, equivalent to 15% of the total withdrawn, is still held by the party. It is unclear whether this was kept as a bounty or if an agreement has been made public.

The recovery came after the hacker requested that every node be patched before sending Bitcoin back, which Blockstream later confirmed had been done. Liquid's operators are working towards a safe restart but have yet to resume operations, with L-BTC deposits and withdrawals remaining halted.