Liquid Network Hackers Return Most of the $320M Bitcoin They Nicked, Hold Rest as Leverage
Someone drained roughly 4,000 Bitcoin from Blockstream's Liquid Network sidechain over the weekend. Then, in a move that's either genuinely principled or extremely theatrical, they gave most of it back.
The attackers returned 3,400 BTC, worth around $262.6 million at time of writing, while holding onto approximately 598 BTC (call it $47 million) pending confirmation that Blockstream has actually patched whatever hole they crawled through. A message embedded in the blockchain made their position clear: fix the bug, prove it's fixed, then you get your money back.
"Please fix the bug first. The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix," the hackers wrote.
This is the classic white-hat-with-a-twist playbook. Do something legally questionable, then claim moral high ground by pointing at the vulnerability you just demonstrated. Whether courts would see the distinction is another matter entirely.
Liquid's federation wallet held around 4,200 BTC before the attack. The funds were apparently withdrawn using the SideSwap PAK, a peg-out authorisation key, though Liquid has stated that key was not compromised. Which raises the obvious question of how, exactly, the funds left. No clear answer on that yet.
Blockstream pulled the plug on Liquid's nodes and suspended transactions shortly after discovering the incident. Exchanges were notified and told to pause LBTC deposits and withdrawals. Other assets on the network, including USDT, DePix, and various real-world assets, were reportedly unaffected.
Former Blockstream executive Samson Mow confirmed the partial return and noted the network remains offline while Blockstream and federation members work through additional security fixes, deal with a chain split, and prepare for a restart. No timeline given.
The $47 million still outstanding presumably stays where it is until the hackers are satisfied with the patch. Which puts Blockstream in the mildly awkward position of having their bug-fix schedule dictated by whoever stole from them.
Details on the actual vulnerability remain sparse. Given that the attack vector involved an authorisation key that supposedly wasn't compromised, there's clearly something in the architecture that deserves a harder look once the dust settles.