White-Hat Hackers Claim Responsibility for $320 Million Bitcoin Withdrawal from Liquid Network
A security incident on the Bitcoin Layer 2 network, Liquid, has resulted in the purported withdrawal of approximately 4,000 BTC, valued at $320 million, from the Liquid Federation wallet. The entity claiming responsibility identifies itself as a white-hat hacker group.
Blockstream, a key player in the Liquid ecosystem, is reportedly attempting to communicate with the parties involved via signed on-chain messages.
In an official update, Liquid stated that the funds were moved using the SideSwap PAK (Peg-out Authorization Key). However, the network emphasized that the key itself was not compromised, and no other keys were put at risk. Crypto exchanges have been notified and have either already suspended or are in the process of suspending deposits and withdrawals for LBTC.
Liquid also confirmed that other assets on the network, including USDT, DePix, and real-world assets, remain unaffected. The network has temporarily disabled its bridge nodes, which prevents new transactions from being submitted. This effectively means the sidechain is paused while the security issue is being investigated and resolved.
“Liquid wallets will be impacted, and we’re sorry for any inconvenience,” a statement from Liquid read. “Federation members are actively working on resolving this so we can restore normal network activity.”
A public exchange is unfolding on-chain between Blockstream and the party claiming to be the white-hat hacker responsible for the withdrawal. Samson Mow, a prominent figure in the crypto space, noted that the hacker appears to prefer public communication through Bitcoin transaction data rather than email.
The interaction began around 11:30 AM PDT, when the hacker posted a message stating, “we are whitehats. contact us on chain.” Blockstream responded at 12:31 PM on September 6, requesting the hacker to contact their security team via email. Subsequently, Blockstream sent an encrypted, PGP-signed message to the hacker’s key.
Mow provided a summary of the public conversation, highlighting the preference for on-chain communication over email.
At 7:20 PM, the hacker indicated an intention to return most of the funds and inquired about the acceptability of a specified address. Approximately an hour later, the hacker stated that the bug needed to be fixed first, adding, “The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix.”
Blockstream responded with a simple “Yes, thank you” at 8:30 PM. As of 9:12 PM PDT, around 3,998.5 BTC remained in the wallet, with no further messages exchanged between the parties.
Charles Guillemet, CTO of Ledger, expressed skepticism regarding the white-hat claim. He pointed out that legitimate security researchers typically do not drain a bridge and then request on-chain contact. Guillemet drew parallels to past incidents like the Ronin hack, where validator keys were compromised, and the Euler exploit, where the attacker negotiated for the return of stolen funds. He added that while criminal groups don’t usually contact their victims, the behavior observed in this case is not characteristic of typical white-hat activity.
Leave a Reply