Hassan Maishera
TL;DR
-
The attacker who withdrew roughly 4,000 BTC from Liquid Network returned 3,400 BTC after Blockstream patched its bridge nodes.
-
The party communicated with Blockstream through Bitcoin OP_RETURN messages and encrypted text.
-
Approximately 598.5 BTC, worth about $47.3 million, remained in the attacker’s wallet.
-
SideSwap said its systems and Peg-out Authorization Key were not compromised.
Liquid Network Attacker Returns 3,400 BTC After Blockstream Patches Bug
The attacker who withdrew approximately 4,000 BTC from Liquid Network’s federation wallet over the weekend has returned about 85% of the funds following confirmation that Blockstream had patched its bridge nodes.
The purported white-hat hacker communicated with Blockstream using Bitcoin OP_RETURN messages and PGP-encrypted text.
In a message included in block 965,875, the party instructed Blockstream to fix the vulnerability and ensure that every node had been patched before the funds would be returned.
Blockstream, which is led by Adam Back, subsequently published a PGP-signed onchain message confirming that the bridge nodes had been patched and that it was safe to return the bitcoin. The signature matched the security key published on Blockstream’s website.
The attacker then transferred 3,400 BTC back to the federation address in block 965,950. Approximately 598.5 BTC, valued at around $47.3 million at the time, remained in the party’s wallet.
Onchain Messages Facilitated the Return
The transfer followed an earlier message in which the attacker offered to return most of the bitcoin to Liquid Network’s federation address.
Blockstream had initially attempted to contact the party through a transaction included in block 965,822. The message asked the attacker to communicate directly with the company’s security team.
The attacker did not appear to use a conventional communication channel. Instead, the parties exchanged authenticated messages through the Bitcoin blockchain, allowing Blockstream to publicly confirm that the relevant software had been patched before the funds were returned.
The incident began on September 6, when Liquid Network disclosed that roughly 4,000 BTC—worth approximately $320 million at the time—had been withdrawn from its federation wallet.
The funds were released through SideSwap’s Peg-out Authorization Key. However, Liquid said the authorization key itself had not been compromised.
SideSwap explained that the affected transaction involved 4,000 LBTC sent to its peg-out service. The platform burned the tokens under a valid peg-out authorization, prompting the Liquid Federation to release 3,996 BTC to the customer’s Bitcoin address.
Blockstream later determined that the LBTC used in the transaction had been created through a vulnerability in Elements, the software underpinning Liquid Network.
As a result, the peg-out appeared valid to SideSwap even though the LBTC had originated from a software flaw. SideSwap maintained that neither its internal systems nor its Peg-out Authorization Key had been breached.
Liquid Network Services Remain Suspended
Liquid Network paused activity following the incident as developers investigated and patched the vulnerability. Bridge nodes were disabled, while exchanges suspended LBTC deposits and withdrawals.
SideSwap also paused swaps, peg-ins and peg-outs. The platform said those services would remain unavailable until Liquid Network resumed normal operations.
Although most of the withdrawn bitcoin has now been returned, nearly 600 BTC remained under the attacker’s control at the time of reporting. Blockstream and Liquid Network had not disclosed whether the outstanding amount would also be returned or whether part of it would be treated as a security bounty.
