Liquid Sidechain Hacked for $320 Million, Hackers Demand Bug Fix
A significant security breach occurred on the Liquid Network, a Bitcoin sidechain developed by Blockstream. Approximately 4,000 BTC, valued at around $320 million, were withdrawn from its primary federation wallet.
The incident began when SideSwap, a platform offering a peg-out service and Liquid federation member, received 4,000 L-BTC from a user. These tokens were promptly burned under a legitimate process, but the federation wallet paid out 3,996 BTC to the user just 23 minutes later.
Blockstream and SideSwap maintained that neither the peg-out key nor any other federation key was compromised, instead pointing to a software bug affecting Elements, the open-source framework upon which Liquid operates. The federation wallet balance plummeted from approximately 4,200 BTC before the incident to around 200 BTC after.
The party behind the withdrawal identified themselves as 'whitehats,' initiating a communication exchange with Blockstream through on-chain messages secured with PGP signatures. They demanded that Blockstream patch the identified Elements software bug and update every node before returning the majority of the stolen BTC.