The Liquid Network has paused bridge operations after actors claiming to be white-hat hackers withdrew roughly 4,000 BTC worth approximately $320 million from its federation wallet.
The amount represented approximately 95% of the wallet’s roughly 4,200 BTC balance before the incident.
Liquid disabled bridge nodes, preventing new transactions, while exchanges began suspending or preparing to suspend L-BTC deposits and withdrawals.
The purported attackers communicated through onchain messages, saying they would return most of the Bitcoin after the underlying vulnerability was fixed and all affected nodes had been updated. At the latest reporting, the BTC had not been returned.
SideSwap said the withdrawal used its peg-out service but that its authorization key had not been compromised. According to the company, the L-BTC originated through a bug in Elements, the open-source software underlying Liquid.
Liquid said other network-issued assets including USDT, DePix and real-world assets were unaffected.
TOKEN RECON ASSESSMENT
Calling the actors “white hats” does not make this a non-event.
Four thousand BTC left controlled infrastructure without authorization.
Until the vulnerability is independently understood, patched and the funds are returned, Token Recon treats this as a major security incident.
The fact that the apparent flaw may lie in core Elements software also raises broader questions for any systems relying on the same codebase.
Watch Blockstream’s technical disclosure, the onchain BTC addresses and whether the promised return actually occurs.
Sources: CoinDesk — Liquid $320 million exploit · Cointelegraph — Liquid response and onchain communications
