Liquid Network hack: White hat, black hat, or something else?

​The party that exploited the Liquid Network first identified itself as a white-hat actor in an on-chain message. But that label has not been accepted by much of the Bitcoin userbase. After roughly 4,000 Bitcoin left the multisig federation wallet that backs Liquid Bitcoin (L-BTC) on the Liquid Network, the same party returned 3,400 Bitcoin and kept about 598.5 Bitcoin, worth roughly $47 million at the time of the drain, for themselves. The discussion that followed on Bitcoin Twitter has at times turned into an intense debate over whether that leftover stack is a bug bounty, a ransom, or something else.

Reviewing what happened

On September 6, a consensus bug in Elements, which is the open-source software that powers Liquid, allowed a party to create about 4,000 L-BTC that was not backed by any corresponding deposit on the base Bitcoin blockchain. Chainalysis later described the flaw as a problem in how Liquid nodes cached range-proof checks used by Liquid’s privacy enhancing technology, known as Confidential Transactions. Invalid data could be treated as a previously verified result, which let attackers mint unbacked L-BTC.

The Liquid Federation released about 3,996 Bitcoin to the destination address on the Bitcoin blockchain because the transaction appeared to involve the burning of legitimate, valid L-BTC. To be clear, no federation keys were stolen or compromised in the attack. That said, SideSwap took responsibility for their own role in the incident because they had not implemented sufficient sanity checks or time delays related to their automated peg-out system. “That design is what turned a reversible event on Liquid into an irreversible payment on Bitcoin,” SideSwap wrote.

Eventually, the hackers sent 3,400 Bitcoin back to the federation address and kept the rest. Talks between the two parties have continued via OP_RETURN transactions published to the Bitcoin blockchain since then; however, it’s currently unclear if the hackers will send more funds back to the federation address after the public negotiations became increasingly heated.

The fact that the hackers are still holding nearly 600 Bitcoin is what has caused a debate over how this incident should be classified. Some Bitcoin users and crypto industry insiders treat it as an unofficial bounty extracted after a sloppy security failure, while others claim holding the coins while demanding a patch, and then keeping a cut, is grey-hat at best and criminal extortion at worst.

Proponents of the grey-hat view

Layer Two Labs CEO and drivechains inventor Paul Sztorc argued, “I think the 15% tip is pretty reasonable.” Without some payment, he wrote, the incentive is “take ALL coins immediately,” “immediately MIX them all,” and “do NOT contact anyone, ever.” He later added that what he perceived as a lack of gratitude for the returned 3,400 Bitcoin “does seem to me to be pretty messed up.”

View post on X Loading...

The tweet was deleted by the author.

But we saved everything 🙂.

USDT0 co-founder Lorenzo Romagnoli also shared arguments sympathetic to the Liquid Network hacker in a back-and-forth with AnchorWatch CEO Rob Hamilton. “He literally gave back 3,400 BTC, you have no idea how unlikely this is,” he wrote, adding that “[North Korea] would have rekted the whole thing, that is a black hat.”

View post on X Loading...

The tweet was deleted by the author.

But we saved everything 🙂.

The Bitcoin-Dollar author Mark Goodwin shared a similar sentiment, posting, “Imagine having almost 300mil returned to you by a hacker after you and 14 of your friends failed to store it safely and then complaining about it?”

View post on X Loading...

The tweet was deleted by the author.

But we saved everything 🙂.

To be clear, there don’t appear to be any prominent Bitcoin industry insiders who go as far as to refer to this as a strictly white-hat hacking incident.

The black-hat case

The opposing camp in this discussion is more interested in the fact that the hackers are still holding 600 Bitcoin derived from the incident than the 3,400 that has already been returned. Bitcoin developer and author of various Bitcoin Improvement Proposals (BIPs) Calvin Kim warned that treating the 15% cut as acceptable sends a clear message. 

View post on X Loading...

The tweet was deleted by the author.

But we saved everything 🙂.

“Hack people and take 15%. It's not even seen as theft!” he wrote. “At this pace I wouldn't be surprised if we get folks making [pull requests] with vulnerabilities so that they can hack and get their 15%.”

Ledger CTO Charles Guillemet called it “straight extortion.” “If these people were honest, they would have contacted Blockstream and explained the vulnerability to the security team,” he wrote. “From there, Blockstream would have decided what was best for Liquid and its users: pause the network, fix the vulnerability, and then pay the researcher(s) a bounty. Any other behavior is extortion.” In an earlier post, after the 3,400 Bitcoin was returned, he also stated, “It looks more like extortion than white-hat hacking!”

View post on X Loading...

The tweet was deleted by the author.

But we saved everything 🙂.

The aforementioned Hamilton has been just as direct. “We don’t know what the encrypted comms were doing, but holding the stack while negotiating a cut isn’t white hat behavior,” he wrote in reply to Sztorc. In a separate conversation, Hamilton also pointed out that the whole white-hat frame started with the attackers. “We wouldn't even be using the word white hat if the attacker didn't start the entire overtone window framing by self identifying as a white hat. No thanks, not starting the conversation accepting their framing.”

One cannot simply refer to themselves as ‘white hat’

It’s also worth noting that the self-proclaimed “white hat” label may not matter in court. Gart founder Alena Vránová wrote that exploiting the bug, taking 4,000 Bitcoin, and demanding a fix is extortion. “This can mean felony charges and long prison time,” she added. “In the U.S. up to 20 years, and computer-fraud charges can add more.” In follow-up posts she sketched the elements courts look for, namely a demand, a threat of harm if the demand is not met, and intent to obtain property or an advantage. “They can't ‘take or keep something as bounty,’” she wrote. “If they do, it's theft + extortion + fraud.”

View post on X Loading...

The tweet was deleted by the author.

But we saved everything 🙂.

Pseudonymous Bitcoin Magazine technical editor Shinobi made a similar point after the partial return of the drained funds. If the party had sent 100% back, he argued, a bounty might have been possible “completely in the legal clear.” Keeping a cut after a public negotiation, he wrote, leaves them “dead to rights nailed on extortion literally conducted in public.”

View post on X Loading...

The tweet was deleted by the author.

But we saved everything 🙂.

A loss Liquid would struggle to earn back

One point that has been somewhat lost in the discussion is that Liquid has never been a strong generator of revenue and has long been mocked for relatively limited use. Humorously, when asked by an X user how long it would hypothetically take the Liquid Network to cover the current 600 Bitcoin deficit from transaction fees alone, Grok estimated it would take about 258 years.

That said, Blockstream made it clear that they will not be paying what they perceive to be a ransom related to the Liquid Network hack. On X, the company stated, “Blockstream will not pay a ransom for the return of stolen funds. Taking assets without authorization and withholding their return is a crime, not responsible disclosure. It is not white-hat activity. It is theft.”