Whitehat Hacker Holds $320M in Drained Bitcoin Until Liquid Network Fixes Fatal Flaw

A massive security incident on the Liquid Network has left nearly $320 million in Bitcoin stranded after a 'whitehat' hacker drained the funds, citing a fatal network flaw that needs to be patched.

The incident began on September 6 when a customer submitted 4,000 L-BTC to SideSwap's peg-out service. The request passed the normal authorization process and prompted Liquid to release about 3,996 BTC. However, it appears that a software bug in Elements, the underlying software of Liquid, created L-BTC without corresponding Bitcoin backing.

Liquid and SideSwap claim that no key compromise occurred, but instead blame a flaw in Elements for allowing the unauthorized withdrawal. The federation's functionaries ultimately signed the transaction, which points to a failure from a conventional bridge exploit.

The whitehat hacker has been communicating with Blockstream through Bitcoin transactions, initially planning to send 'most' of the Bitcoin back once the bug is fixed and every node is patched.