Liquid Network, a blockchain, associated with Bitcoin, has fallen victim to a security incident. “Alleged white-hat hackers have withdrawn around 4,000 Bitcoin (worth approximately 320 million US dollars) from the Liquid Federation wallet”, the payment and settlement network, used by numerous crypto exchanges, announced on Sunday via a tweet on the X platform. Liquid Network has thus lost almost its entire balance; before the incident, there were about 4,200 BTC there.
Liquid Network was founded in 2018 by the blockchain technology company Blockstream. Crypto exchanges use the network for faster transactions. Due to network congestion on Bitcoin’s main blockchain, settlements there are often slow. Liquid Network speeds up the process by issuing Liquid Bitcoin (L-BTC) in exchange for actual Bitcoin (BTC), which are then locked.
Unsuspicious Transaction
According to initial findings, the funds were withdrawn via the SideSwap-PAK, a settlement platform authorized for processing withdrawals from the network. However, this key has not been compromised, nor have other keys, according to Liquid Network. The connected crypto exchanges have been notified and have suspended deposits and withdrawals of L-BTC linked to Liquid Network. Other Liquid assets such as USDT, DePix, and RWAs are therefore not affected by the security incident. Bitcoin itself is also not affected; the error is presumably in the system built on top of Bitcoin, not in Bitcoin itself.
According to Cryptoticker.io, an online portal for blockchain and cryptocurrencies, the sequence of events can be precisely traced. According to the report, a customer sent 4,000 L-BTC to SideSwap’s peg-out service at 12:05 PM CEST. As a member of the Liquid Federation, SideSwap is a regular way to exchange L-BTC for real Bitcoin. “The order was processed like any other: the L-BTC were burned on Liquid, a valid peg-out authorization was present, and 23 minutes later, the Federation paid out around 3,996 BTC on the Bitcoin mainchain”, Cryptoticker.io writes. Nothing about this transaction appeared suspicious.
Possible Cause: Software Bug
Liquid Network has, according to its own statement, paused the Liquid sidechain until the problem is resolved. “The bridge nodes have been temporarily deactivated so that no new transactions can be sent to the network”, Liquid Network wrote, and apologized “for any inconvenience”. They are actively working on solving the problem to restore normal network operation.
A software bug in Elements, the open-source codebase on which Liquid runs, is reportedly responsible for the release of the 4,000 BTC, Cryptoticker.io writes. According to the portal, the attacker attached a message to a Bitcoin transaction, identifying themselves as a white-hat hacker, i.e., someone who exploits security vulnerabilities and usually returns the funds, sometimes for a fee. The Liquid Network attacker also stated that they would return most of the BTC once the bug is fixed and all nodes are updated. Both sides are currently negotiating – the outcome is uncertain.
(akn)