Liquid Network attacker returns 3,400 BTC after vulnerability fix
The suspected white-hat hacker who withdrew around 4,000 BTC from the Liquid Network federation wallet returned 3,400 BTC after the vulnerability was fixed. About 598.5 BTC worth $47.3 million remained at the attacker's address.
The incident occurred on September 6, when around 4,000 BTC worth approximately $320 million was withdrawn from the federation wallet. Liquid subsequently paused the network, disabled its bridge nodes, and asked exchanges to suspend LBTC deposits and withdrawals.
According to The Block, the attacker contacted network developer Blockstream through OP_RETURN messages on the Bitcoin blockchain and PGP-encrypted text. The attacker said the funds would be returned only after the bug had been fixed on every node.
Blockstream fixed vulnerability before funds were returned
In a message at block 965,875, the hacker demanded that Blockstream first "fix the bug" and make sure every node had been patched.
Blockstream later sent a PGP-signed on-chain message stating that the bridge nodes had been patched and the funds could safely be returned. The signature matched the security key published by the company.
The hacker then transferred 3,400 BTC back to the federation address at block 965,950. This amounted to roughly 85% of the withdrawn funds.
About 598.5 BTC remained in the attacker's wallet, valued at $47.3 million at the time of publication. It remains unclear whether the hacker intends to return the remaining amount.
Blockstream initially attempted to contact the hacker through a transaction at block 965,822 and asked the attacker to reach out to the company's security team. In response, the hacker said most of the Bitcoin would be returned once the vulnerability had been fixed.
Elements software bug caused the incident
The withdrawal took place through the SideSwap Peg-out service. According to the platform, 4,000 LBTC were sent to it and subsequently burned using valid authorization, after which the Liquid Federation released 3,996 BTC to the user.
Blockstream later determined that the LBTC used in the transaction had been created due to a bug in the Elements software. SideSwap stressed that its systems and Peg-out Authorization Key had not been compromised.
Following the incident, Liquid disabled its bridge nodes, while exchanges suspended LBTC deposits and withdrawals. SideSwap also halted swaps as well as Peg-in and Peg-out operations until the network fully resumes operations.
Earlier, the Cronos blockchain, which is closely associated with Crypto.com, was completely halted following an attack on Tectonic, the largest lending protocol in its ecosystem. Preliminary losses from the incident were estimated at around $75 million.
The attack led to a temporary suspension of network operations while developers investigated the cause of the incident and worked to restore the security of the infrastructure.
Earlier, we also reported that hardware wallet manufacturer Coldcard strengthened its security mechanisms after an $112 million crypto wallet hack. The incident once again drew attention to the risks of storing large amounts of digital assets and securing Bitcoin infrastructure.
Latest Bitcoin News
-
Afghanistan
-
Albania
-
Algeria
-
Angola
-
Argentina
-
Armenia
-
Australia
-
Austria
-
Azerbaijan
-
Bahamas
-
Bahrain
-
Bangladesh
-
Belarus
-
Belgium
-
Bolivia
-
Botswana
-
Brazil
-
Brunei
-
Bulgaria
-
Cambodia
-
Cameroon
-
Canada
-
Chile
-
China
-
Colombia
-
Congo
-
Costa Rica
-
Cote d'Ivoire
-
Croatia
-
Cuba
-
Cyprus
-
Czechia
-
DR Congo
-
Denmark
-
Dominican Republic
-
Ecuador
-
Egypt
-
El Salvador
-
Estonia
-
Eswatini
-
Ethiopia
-
Finland
-
France
-
Georgia
-
Germany
-
Ghana
-
Greece
-
Haiti
-
Hong Kong
-
Hungary
-
India
-
Indonesia
-
Iran, Islamic republic
-
Iraq
-
Ireland
-
Israel
-
Italy
-
Jamaica
-
Japan
-
Jordan
-
Kazakhstan
-
Kenya
-
Korea
-
Kuwait
-
Kyrgyzstan
-
Laos
-
Latvia
-
Lebanon
-
Lesotho
-
Libya
-
Lithuania
-
Luxembourg
-
Madagascar
-
Malaysia
-
Malta
-
Mauritius
-
Mexico
-
Moldova
-
Mongolia
-
Montenegro
-
Morocco
-
Mozambique
-
Myanmar
-
Namibia
-
Nepal
-
Netherlands
-
New Zealand
-
Nigeria
-
North Macedonia
-
Norway
-
Oman
-
Pakistan
-
Palestine
-
Panama
-
Papua New Guinea
-
Paraguay
-
Peru
-
Philippines
-
Poland
-
Portugal
-
Puerto Rico
-
Qatar
-
Reunion
-
Romania
-
Rwanda
-
Saudi Arabia
-
Serbia
-
Singapore
-
Slovakia
-
Slovenia
-
Somalia
-
South Africa
-
Spain
-
Sri Lanka
-
Sweden
-
Switzerland
-
Syria
-
Taiwan
-
Tajikistan
-
Tanzania
-
Thailand
-
Trinidad and Tobago
-
Tunisia
-
Turkey
-
UAE
-
Uganda
-
Ukraine
-
United Kingdom
-
United States
-
Uruguay
-
Uzbekistan
-
Venezuela
-
Vietnam
-
Yemen
-
Zambia
-
Zimbabwe
- Forex
- Crypto
