Blockstream’s Liquid Network hacked for 4,019 BTC, sidechain paused

The Liquid Network reported that hackers withdrew approximately 4,000 $BTC, valued at nearly $320 million, from the federation wallet that backs its LBTC sidechain asset on Sunday. Following the incident, Liquid immediately paused its bridge nodes and suspended L-$BTC deposits and withdrawals to prevent further unauthorized transactions. Assets such as USDT, DePix, and RWAs issued on the network remained unaffected, according to the official Liquid Network account.

Details of the Exploit

The Liquid Network, a federated Bitcoin sidechain developed by Blockstream, enables fast and confidential transfers by issuing tokens like LBTC, which is backed 1:1 by bitcoin held in a multi-signature wallet. This wallet operates under the control of 15 federation members, requiring the signatures of 11 members for fund movements. Before the security breach, the reserves accounted for over 4,200 $BTC; afterwards, Blockstream’s proof of reserves page indicated a steep drop to just over 200 $BTC.

Hackers managed to drain 4,019.4 $BTC from the reserve via a peg-out transaction, exploiting the SideSwap Peg-out Authorization Key. SideSwap, a bridge exchange and member of the Liquid Federation, appears to have been central to the technical flaw. Preliminary evidence suggests that the attackers took advantage of an inflation bug on the LBTC sidechain, allowing them to mint over 4,000 counterfeit LBTC and redeem this for real bitcoin held in the treasury. As the transaction complied with Liquid’s consensus rules at the time, the system’s security modules, called HSMs, signed off on the withdrawal, permitting the attackers to transfer a sum worth roughly $320 million.

Mini dictionary: Hardware Security Module (HSM): A physical or virtual device designed to safeguard and manage digital keys, perform cryptographic operations, and increase overall security for sensitive blockchain actions and key management.

White-Hat Claims and Ongoing Negotiations

The hackers moved the stolen bitcoin to an address ending in 6gyqjlte and attached a message in the OP_RETURN data field stating “we are whitehats. contact us on chain.” At the time of publication, the full amount remained at this address. Later, an on-chain message from the suspected Blockstream team requested contact via the provided security email address, although this has not been concretely verified. The attacker responded with a further OP_RETURN message containing instructions to communicate over Signal, an encrypted messaging platform.

Blockstream, a Canadian blockchain technology company founded by Adam Back, is the principal developer behind Liquid Network. Liquid is known for its federated model, in which a select group of entities operates the bridge between Bitcoin and its sidechain assets. The network’s private technical architecture makes external investigation challenging, particularly around retail exposure and address balances.

Mini dictionary: OP_RETURN: A special feature in Bitcoin transactions that allows a small amount of data to be embedded in the blockchain, often used for attaching messages or signals related to a transaction.

User Impact and Industry Response

Liquid recommended that exchanges and service providers halt all LBTC transactions until further notice. While the sidechain continues to produce blocks, bridges to the Bitcoin mainnet remain suspended.

Samson Mow, CEO of JAN3, stated that the hack impacted Aqua, a wallet that relies on the Liquid Network, but clarified that standard bitcoin transactions continue unaffected. Other industry wallets and services integrated with Liquid may be similarly affected.

Users holding LBTC currently face uncertainty over their token backing, as the bitcoin reserves are no longer sufficient for redemption. Public data is limited, so the proportion of retail versus institutional exposure remains unclear, but the incident is considered significant for both corporate and individual users who depend on the security of the Liquid Network.

LBTC holders now risk their savings, as the underlying $BTC reserves are unavailable for redemption, leaving few options but to await a resolution with the hackers.

Given the scale of the heist and the public messages left by the attackers, some industry sources believe a finder’s fee or partial return of funds could be negotiated. However, if the bitcoin is not recovered, the breach would mark a substantial setback for the Liquid Network and its community.