Liquid Network Hack: White Hats Return 3,400 Bitcoin, But Keep $47 Million

Set Trending Topics as a preferred source on Google.

The attack on Liquid, the Bitcoin sidechain operated by Blockstream, has been settled for now, and the settlement came at a steep price. The group that withdrew roughly 4,000 BTC from the network’s federation wallet on Sunday sent 3,400 BTC back on Monday. The remaining 598.5 BTC stayed at the attackers’ address as a self declared finder’s fee. At a bitcoin price of around $78,500, that comes to about $47 million, or roughly 40 million euros. It is exactly 15 percent of the amount originally withdrawn.

Trending Topics has already reported on the incident itself: 4,000 L-BTC were redeemed through the peg-out path of the service provider SideSwap, after which the Liquid Federation paid out nearly 3,996 real bitcoin to a Bitcoin address. According to the network, SideSwap’s peg-out authorization key was not compromised. SideSwap says the root cause was a bug in Elements, the software Liquid is built on. The network was paused, and exchanges halted L-BTC deposits and withdrawals.

Negotiating Inside the Blockchain

The remarkable part is how the two sides talked to each other: through messages written directly into Bitcoin blocks. The group, which describes itself as white hats, first surfaced with a “contact us on chain” in the OP_RETURN field of a transaction, sent from the address holding the 4,000 BTC. An address linked to Blockstream replied by pointing to security@blockstream.com. From there, both sides moved to encrypted and PGP signed messages whose signatures can be checked against Blockstream’s published security key.