Liquid Hackers Return 3,400 Bitcoin Taken via Elements Bug, Still Holding $47M in BTC
Hackers initially stole approximately 4,000 Bitcoin from the Liquid Network, but returned 3,400 Bitcoin the following day. The incident stemmed from a bug within the Elements software used by Liquid, allowing the attackers to exploit the system and drain the network's reserves. While the group initially claimed to be 'white hats,' a technical analysis suggests the situation may have been an extortion attempt. The network is currently undergoing a coordinated restart to restore the backing of L-BTC, and users are advised not to deposit Bitcoin into Liquid's peg-in addresses until the restart is confirmed.
The Liquid Network experienced a significant security breach on September 6, with hackers initially stealing approximately 4,000 Bitcoin. The network was subsequently paused, preventing users from converting L-BTC tokens back into Bitcoin. The following day, September 7, the attackers returned 3,400 Bitcoin to the Liquid Federation address.
This incident was directly linked to a bug within the Elements software, the software Liquid runs on. A technical analysis suggests the flaw allowed the attackers to exploit the system and drain the network's reserves. The group initially claimed to be ‘white hats,’ but this claim is being questioned, with some suggesting the situation was a negotiated extortion scheme based on encrypted messages on the blockchain.
Blockstream, which provides the technology for Liquid, announced the incident and stated that its bridge nodes were patched and the funds were safe to return. The two sides engaged in public communication on the Bitcoin blockchain, with the group demanding the flaw be fixed and all nodes patched before releasing the funds. Blockstream responded with a signed message confirming the updates.
On September 7, a transaction confirmed the return of 3,400 Bitcoin, followed by 1,000 satoshis (0.00001 bitcoin) with a PGP-encrypted message. As of September 8, Blockstream's status page still listed the incident as active, with its public bridge nodes down, and had not been updated to reflect the return of funds. The network is currently preparing a coordinated restart to restore the backing of L-BTC, and users are advised not to send Bitcoin to Liquid's peg-in addresses until the restart is confirmed. Other assets issued on Liquid, including USDT and DePix, are unaffected. Samson Mow, chief executive of JAN3 and a former Blockstream executive, stated that approximately 598 Bitcoin remains unreturned, and Blockstream is still in contact with the group.