Liquid Network suffers $320M hack as 4,000 BTC drained from federation wallet

Blockstream's Liquid Network, one of the oldest and most prominent Bitcoin sidechains, lost approximately 4,000 BTC, worth roughly $320 million, after hackers exploited a bug in its underlying software on September 6. The federation's reserves cratered from over 4,200 BTC to about 197 BTC in a single stroke, making it one of the largest security breaches involving a Bitcoin-adjacent network this year.

The silver lining, if you can call it that: the attackers identified themselves as white-hat hackers and returned around 3,400 BTC after Blockstream confirmed it had patched the vulnerability. They kept approximately 598 BTC, valued at roughly $47 million, as a self-appointed bounty.

The vulnerability lived in the Elements software, the open-source codebase that powers the Liquid Network. Specifically, a range-proof verification cache bug allowed the attackers to create invalid Liquid Bitcoin (L-BTC) tokens that the system accepted as legitimate. Those fraudulent tokens were then processed through SideSwap's Peg-out Authorization Key (PAK), which converted them into real BTC withdrawals from the federation wallet.

Critically, no federation keys were compromised during the attack. The Liquid Network operates on an 11-of-15 federation multisig model, meaning 11 out of 15 designated entities must sign off on transactions. The multisig itself held up fine. The problem was upstream: the software that validates what gets sent to the multisig in the first place.