The Liquid Network, a Bitcoin sidechain developed by Blockstream, was drained of roughly 4,000 bitcoin worth about $320 million on Sunday. The person or people behind the exploit said they were white hat hackers and communicated with Blockstream through messages embedded in Bitcoin transactions using OP_RETURN. The attackers have since returned 3,400 bitcoin to the Liquid federation, while keeping 598.5 bitcoin (currently worth around $47 million).

The incident does not appear to have involved compromised keys from the multisig address that underpins the network on the base Bitcoin blockchain. Instead, an apparent bug in Liquid’s node software allowed attackers to create unbacked Liquid Bitcoin (L-BTC) and then use those coins to trigger a legitimate-looking peg-out from the sidechain back to Bitcoin’s base network.

What Is the Liquid Network?

Liquid is a sidechain designed to move bitcoin and other assets onto a separate blockchain with faster transactions and additional features, including more private transactions and asset issuance. It is operated by the Liquid Federation, a group of Bitcoin-focused companies that includes exchanges, trading firms, wallet providers, and other infrastructure businesses. Blockstream develops much of the network’s software and works with the federation on its technical roadmap.