Liquid Network Hit by $320M Hack, Attacker's $270M Return Sparks Controversy

Blockstream's Liquid Network, a Bitcoin layer-2 solution, was hit by a significant security breach over the weekend when malicious actors extracted approximately 4,000 Bitcoin from the federation's custody wallet. This wallet serves as the backing mechanism for L-BTC, maintaining a 1:1 peg with the sidechain's primary asset.

The attackers used SideSwap's Peg-out Authorization Key to execute the unauthorized withdrawal, which emptied nearly all of Liquid's 4,200 BTC backing. This created an immediate shortfall for L-BTC token holders and left only 197 BTC in reserves. The breach did not impact other digital assets operating on Liquid, such as tether.

The individuals behind the attack claimed to be ethical hackers operating with good intentions and indicated their willingness to restore the stolen assets after receiving confirmation that the security flaw had been resolved and all network nodes had implemented necessary updates.

Blockstream initiated communication by incorporating cryptographically signed messages within Bitcoin transactions. The attackers transferred 3,400 Bitcoin back to the federation's custody wallet following Blockstream's verification that bridge infrastructure had received security patches. This amount represents roughly 85% of the total funds extracted and has a value of around $270 million.