Bitcoin sidechain Liquid pauses after purported ‘white hats’ withdraw $320M in BTC
The Liquid Network, a Bitcoin sidechain, paused operations after alleged white-hat hackers withdrew approximately 4,000 Bitcoin, valued at $320 million, from its federation wallet. The actors claim they will return most of the funds once a vulnerability in the underlying …
Intelligence analysis by Gemini 2.5 Flash
Liquid Network halted transactions and exchanges stopped L-BTC deposits/withdrawals following a significant Bitcoin withdrawal by actors identifying as white hats. Blockstream, Liquid's technology provider, is in communication with these actors, who have demanded a vulnerability fix before returning the majority of the withdrawn funds.
Imagine a special train track that helps Bitcoin move faster, but it needs a big safe to hold some real Bitcoin as a guarantee. Someone found a secret trick to take a lot of Bitcoin out of that safe. They say they're good guys and will give it back if the safe's lock is fixed for everyone. Now, the train track is stopped, and everyone is waiting to see if the Bitcoin comes back and the lock is made super strong.
Analysis
Liquid Network Operations
The Liquid Network, a prominent Bitcoin sidechain, experienced a significant operational disruption following the withdrawal of approximately 4,000 Bitcoin, valued at $320 million. This event led to the immediate pausing of network operations, with bridge nodes disabled to prevent new transactions and exchanges halting L-BTC deposits and withdrawals. The withdrawn funds represented a substantial portion, roughly 95%, of the federation wallet's total balance, which is crucial for backing L-BTC issued on the sidechain. While the L-BTC system was directly impacted, other assets issued on Liquid, such as USDT, DePix, and various real-world assets, were reportedly unaffected by the incident.
Blockstream's Engagement
Blockstream, the technology provider behind the Liquid Network, swiftly engaged with the actors responsible for the withdrawal. Communication was established through signed on-chain messages, indicating a direct and public dialogue between the parties. According to a detailed timeline compiled by Jan3 CEO Samson Mow, the actors identified themselves as 'white hats' and requested on-chain contact, to which Blockstream responded by directing them to a security email and later sending a PGP-encrypted message. The purported white hats subsequently expressed willingness to return most of the Bitcoin, but made this contingent on the vulnerability being fixed and every node updating their software, a condition Blockstream acknowledged without explicitly agreeing to the sequence.
Elements Vulnerability
The core of the security breach appears to stem from a vulnerability within Elements, the open-source software that underpins the Liquid Network. SideSwap, a service involved in the transaction, clarified that the L-BTC used in the withdrawal originated from a bug in Elements, rather than a compromise of SideSwap's own systems or its Peg-out Authorization Key (PAK). This distinction is critical, as it points to a fundamental flaw in the sidechain's foundational software rather than an application-layer exploit. The actors' demand for a comprehensive patch across all nodes before returning the funds underscores the severity and systemic nature of the identified vulnerability, emphasizing the need for a robust and widespread security update.
Key points
- The Liquid Network paused operations after approximately 4,000 Bitcoin ($320 million) was withdrawn from its federation wallet.
- The actors responsible claim to be white-hat hackers and have offered to return most of the funds.
- The return of funds is contingent on Blockstream patching a vulnerability in the Elements open-source software across all network nodes.
- The withdrawal represents about 95% of the wallet's 4,200 BTC balance, impacting L-BTC backing.
- Blockstream is communicating with the actors via on-chain messages and PGP-encrypted emails.
If the actors are indeed white hats and return the majority of the $320 million in Bitcoin after the vulnerability is patched, it could lead to a stronger, more secure Liquid Network. This scenario would demonstrate the effectiveness of responsible disclosure and collaborative security efforts within the crypto space, potentially restoring and even enhancing trust in the sidechain's resilience.
Should the purported white hats fail to return the funds, or if the underlying Elements vulnerability proves difficult to fully resolve, the Liquid Network could face significant long-term trust issues and financial losses. A prolonged network pause or repeated security incidents could deter users and developers, undermining the sidechain's utility and adoption within the Bitcoin ecosystem.
