'White Hat' Liquid Network Crypto Hackers Are Now Grandstanding and Demanding a 10% Bounty

The people who drained Blockstream’s Liquid Network last weekend are no longer content to negotiate in private. After days of PGP-encrypted notes stuffed into Bitcoin transactions, they have switched to plaintext, accused Blockstream of skimping on security, and demanded a 10% bounty paid from the company’s own money.

As previously reported, a software bug in Liquid’s Elements node software let an attacker mint unbacked L-BTC on Sunday and cash it out through SideSwap for roughly 4,000 bitcoin, then worth about $320 million. The Liquid Network is a sidechain of Bitcoin that enables features different from the base network and is backed by a federation of members via a base layer multisig Bitcoin address. To be clear, federation keys were not stolen. Vulnerable nodes treated the fake coins as valid, and the federation’s signers released real bitcoin from the 11-of-15 multisig wallet that backs the sidechain.

The attackers labeled themselves white hats in an OP_RETURN message published to the Bitcoin blockchain following the hack, which led to on-chain negotiations with Blockstream. Later, the hackers sent 3,400 bitcoin back to the Liquid federation after bridge nodes were patched, but they kept 598.5 bitcoin, worth around $47 million, from the initial transaction that drained the Liquid federation of nearly all of its bitcoin reserves.