Security breach drains $320 million in bitcoin from Liquid Network

Liquid Network, a system developed by Blockstream to move bitcoin between exchanges and traders, halted transactions after nearly 4,000 bitcoin worth about $320 million were withdrawn from its reserves in a security breach on Sunday.

The breach appears to have exploited a flaw in the software underpinning Liquid.

The withdrawal accounted for about 95% of the roughly 4,200 bitcoin held in the Liquid Federation wallet before the incident. Liquid described those responsible as “purported white-hat hackers.”

Liquid was launched in 2018 by Blockstream, a Bitcoin technology company co-founded by cryptographer Adam Back. It is operated by a federation of more than 80 exchanges, infrastructure companies, asset managers and other businesses.

Liquid allows users to move bitcoin into its system and receive an equivalent amount of a token known as L-BTC. Each L-BTC is supposed to be backed by bitcoin held by the federation. When a user wants to convert L-BTC back into bitcoin, the token is destroyed and the corresponding bitcoin is released.

The incident did not affect Bitcoin itself.

SideSwap, a service authorized to handle such withdrawals, said a customer sent it 4,000 L-BTC at about 14:05 UTC on Sunday. SideSwap said it processed the request normally, destroying the L-BTC before the Liquid Federation released about 3,996 bitcoin to the customer’s address 23 minutes later.

SideSwap said the key used to authorize withdrawals had not been compromised. Liquid also said it had found no evidence that this or any other relevant key had been stolen.

According to SideSwap, Blockstream later determined that the 4,000 L-BTC had been created through a vulnerability in Elements, the software on which Liquid runs.

That account points to an unusual failure. The system appears to have accepted L-BTC that was not backed by bitcoin and then allowed those tokens to be exchanged for bitcoin held in Liquid’s reserves.

Blockstream has not published a detailed technical report explaining the vulnerability.

The people behind the withdrawal contacted Blockstream through a message embedded in a Bitcoin transaction, describing themselves as white hats and asking the company to contact them.

Blockstream replied through another transaction. Later messages linked to the same group said most of the bitcoin would be returned after the software flaw was fixed and the update installed across Liquid.

One message asked Blockstream to fix the vulnerability first and make sure computers running the network had been updated before the money was transferred back.

There was no confirmation at the time of publication that the bitcoin had been returned. The group’s description of itself as a white-hat operation therefore remains unverified.

Liquid has disabled the systems used to move assets between it and Bitcoin, and exchanges have been told to suspend deposits and withdrawals of L-BTC. Liquid said other assets on its system, including the USDT stablecoin, were not directly affected.

About 200 bitcoin remained in the federation wallet after the withdrawal. Liquid has not said when normal transactions will resume. Blockstream had also not released a full account of the flaw or confirmed the recovery of the bitcoin by the time of publication.