Liquid Network Loses 95% Of Bitcoin Held In Federation Wallet

The hack triggered the withdrawal of about 4,000 bitcoins, valued at nearly 320 million dollars, from the network’s federated wallet. Indeed, the perpetrators claim to be ethical hackers; however, the funds have not yet been returned, and the vulnerability remains unknown.

In Brief

• Nearly 4,000 BTC, valued at approximately 320 million dollars, were withdrawn from the federated wallet of Liquid Network.
• The wallet lost nearly 95% of its bitcoins after two transactions.
• The perpetrators present themselves as ‘white hats,’ but their intentions remain to be confirmed.
• The withdrawals used SideSwap’s PAK, which Liquid asserts was not compromised.
• Bridge nodes were disabled and several platforms suspended deposits and withdrawals of L-BTC.

The Federated Wallet Loses 95% of Its Bitcoins

On September 6, two transactions transferred about 3998.5 bitcoins. This federated wallet held nearly 4200 BTC before the incident, while the 82,000 dollars threshold blocks the crypto’s recovery. Its balance then fell to around 207 BTC after the transactions.

One operation inscribed a message using Bitcoin’s OP_RETURN field a few hours later. The authors stated: “we are white hats. Contact us on the blockchain”. However, this claim does not prove their intentions.

The initial statistics offer a clear idea of this large-scale hack :

• Approximately 3998.5 bitcoins were transferred to the same address ;
• The funds were worth nearly 320 million dollars at the time of the incident ;
• The federated wallet lost about 95% of its balance ;
• Nodes responsible for transfers between Liquid and Bitcoin were disabled ;
• Deposits and withdrawals of L-BTC were suspended on several exchanges.

In a message posted on social network X, Liquid Network confirmed this incident. The network stated:

Alleged ethical hackers withdrew about 4000 BTC from the federation’s wallet.

Then, Blockstream attempted to contact the authors through a signed message on the blockchain. The funds remained concentrated on an identifiable address at the time of early analyses. Thus, their traceability limits laundering possibilities but does not guarantee their return.

SideSwap Key Was Used Without Being Compromised

It is worth noting that Liquid is a sidechain created to accelerate transactions while enabling the issuance of bitcoin-backed assets. Users lock bitcoins on the main network to obtain L-BTC on Liquid. One bitcoin theoretically covers each L-BTC.

To recover bitcoins, the user must destroy their L-BTC. Then, the federation validates the withdrawal to the Bitcoin network. The main wallet relies on a multi-signature requiring agreement from 11 members out of 15.

Another protection relies on the Peg-out Authorization Key, or PAK. With this key, withdrawals to pre-authorized wallets are limited. Ordinary users usually go through a member like SideSwap, according to Liquid’s documentation.

Thus, the network confirms withdrawals used SideSwap’s PAK. However, neither this key nor other authorization keys were compromised.

Liquid emphasizes: “the funds were withdrawn using SideSwap’s PAK, but this key was not compromised”. Such a statement leaves open the fundamental question about the method used.

Many observers mention a possible irregular creation of L-BTC before their conversion into bitcoins. Such a hypothesis has not been confirmed by Liquid or Blockstream. The publication of a technical report will establish the exact cause.

The Bitcoin protocol is not directly involved in this incident. No evidence shows a compromise of the main network or its cryptography. The issue relates to the federated mechanism linking Liquid to Bitcoin.

The Authors Promise a Refund After the Fix

Liquid temporarily disabled its bridge nodes. Thus, a new transaction cannot be submitted to the network. Exchange platforms were also instructed to suspend deposits and withdrawals of L-BTC.

From then on, the federation emphasizes that other assets issued by Liquid, including stablecoins and tokenized assets, are not directly affected. However, Liquid wallets suffered consequences related to the network shutdown.

Other on-chain messages specify that a dialogue has started. According to an analysis, the authors want to return all funds after deploying a fix.

One message states: “first fix the vulnerability. When the fix is confirmed, we will securely transfer the funds”. Also, the PGP key published by Blockstream may have been used to encrypt technical information.

Such a promise does not yet represent a refund. The amount kept as a potential reward is not indicated. Liquid will also need to justify the flaw, verify L-BTC coverage, and detail all recovery conditions.

Despite the crypto’s short-term loss of momentum, a decisive new signal will be the actual return of bitcoins to the federated wallet. Without this transaction and without a technical report, the white hat status claimed by the authors cannot be confirmed.