Liquid Sidechain Hacked: White-Hat Hackers Siphon $320M in Bitcoin

A major incident has occurred on the Bitcoin sidechain Liquid, where actors claiming to be white-hat hackers withdrew approximately 4,000 BTC worth $320 million from its federation wallet. This represents about 95% of the wallet's balance before the incident.

The withdrawal was done through a peg-out service using Peg-out Authorization Key (PAK), but Liquid stated that the key was not compromised. The L-BTC used in the transaction originated from a bug in Elements, the open-source software underpinning Liquid.

Blockstream, Liquid's technology provider, attempted to contact the actors through signed onchain messages. They demanded that Blockstream patch the vulnerability and update every node before they would return most of the Bitcoin. The actors also sent encrypted technical details to Blockstream.