Liquid Network Attacker Returns 85% of Stolen $320 Million in Bitcoin After Blockstream Patches Bug

An attacker who withdrew roughly 4,000 BTC, worth about $320 million at the time, from Blockstream's Liquid Network federation wallet on September 6 has returned 3,400 BTC of it after the company patched the underlying bug, according to Blockstream's official status page. The attacker kept 598.5 BTC, worth about $47 million at current prices, or roughly 15% of the total.

The withdrawal went through SideSwap's Peg-out Authorization Key, one of several keys federation members hold to move funds off the sidechain. Blockstream said on its status page that the key itself "was not compromised, nor were any others," meaning the attacker did not steal a private key but instead exploited a flaw in how Liquid's federation validated peg-out requests, letting 11 of the required signatures push through a transaction that should have needed stronger checks. Other assets on Liquid, including USDT, DePix and various real-world-asset tokens, were unaffected.

Blockstream disabled its public bridge nodes within hours, pausing the sidechain and prompting exchanges to suspend LBTC deposits and withdrawals while federation members investigated. The attacker communicated through OP_RETURN messages embedded in Bitcoin transactions, first writing "we are whitehats. contact us on chain," according to on-chain messages reported by The Block. In one exchange, the attacker offered to send back "most" of the funds on condition that Blockstream fix the bug and patch every node first. Blockstream agreed, replying: "Please fix the bug first. The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix."