Key points
- 4,000 Bitcoin left Liquid through a software bug
- No key was stolen
- Both sides negotiated inside Bitcoin transactions
- Hackers returned 3,400 and kept about $47 million
Hackers pulled about 4,000 Bitcoin, worth about $320 million, out of Blockstream's Liquid Network on Sunday. On Monday, after Blockstream said it had patched its bridge nodes, they sent 3,400 Bitcoin back and kept about 600 Bitcoin, worth about $47 million. Liquid said no signing key was compromised.
Much of the negotiation played out in messages written into Bitcoin transactions. Anyone with a block explorer could follow the public parts, though some messages were encrypted. The hackers opened with "we are whitehats. contact us on chain." Blockstream later replied with a message signed with its security key: "Bridge nodes are patched, safe to return the funds." Protos, The Block and Bitcoin Magazine followed the exchange from Sunday evening through Monday afternoon.
What is the Liquid Network?
Liquid is a Bitcoin sidechain, a separate network run by a group of companies. It settles faster than Bitcoin and keeps transaction amounts private. You lock Bitcoin in a wallet controlled by that group, which is called the federation. In return you get the same amount of Liquid Bitcoin, or L-BTC, to trade on the sidechain. Want your real Bitcoin back? Turn in the L-BTC and the federation signs the withdrawal, which is called a peg-out. That wallet held about 4,200 Bitcoin on Sunday morning, according to Protos.
Here's the part that got me.
Liquid said the withdrawal came through a normal peg-out request. It blamed a validation failure in Elements, the software the sidechain runs on.
Protos reported that the bug let the hackers create L-BTC that wasn't backed by any Bitcoin, then cash it in as if it were. The request went through SideSwap, a trading service whose authorization key sits on the federation's approved list. Eleven of the federation's 15 signers signed the withdrawal. The wallet went from about 4,200 Bitcoin to 197.
Liquid disabled its bridge nodes and said the sidechain was effectively paused. It told exchanges to suspend L-BTC deposits and withdrawals. Other assets issued on Liquid, including Tether's USDT and tokenized real-world assets, weren't affected, the network said.
How did the negotiation work?
Bitcoin transactions can carry short messages using OP_RETURN. That's the channel the two sides used. About an hour after the hackers' first message, Blockstream answered on-chain and asked them to contact the company's security team, The Block reported. The hackers came back with a longer message, part of it encrypted with Blockstream's public key. The readable part said, "Please fix the bug first. The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix."
I've followed a lot of hacks, but I haven't seen the people sitting on $320 million of somebody else's Bitcoin telling the victim to hurry up and patch its software.
Blockstream's patched-and-safe message came Monday. At 16:09 UTC, 3,400 Bitcoin moved back to the federation, Bitcoin Magazine reported. The other 598.5 Bitcoin, about 15% of what was taken, stayed put, and Bitcoin Magazine said four more encrypted messages went out from Blockstream a few hours later. Whether the two sides had agreed to a reward wasn't public. The hackers still had about $47 million.
Not everyone buys the white-hat label, and I get it. Charles Guillemet, chief technology officer at hardware wallet maker Ledger, argued on X that real security researchers report a bug before they move hundreds of millions of dollars, not after, Blockonomi reported. Fair. These guys moved $320 million first and made contact second.
Blockstream's maintenance record drew scrutiny, too. Jameson Lopp, co-founder of the Bitcoin custody firm Casa, pointed out that the "Liquid functionary codebase hasn't been touched in two years," according to Protos, which went and checked and found the last commit to that code was made on April 19, 2024.
Bitcoin traded near $79,300 on Monday evening, down 0.3% from the previous day's close, according to Robinhood market data. The 598.5 Bitcoin were still sitting at the hackers' address Monday night. Liquid hadn't said when the sidechain would come back.
