Liquid Network $320M Exploit
Liquid Network suspends operations after a major exploit drains $320 million in Bitcoin.
Anonymous
Key Points
1
The withdrawal totaled 4,019.4 BTC, reducing Liquid’s reserves from more than 4,200 BTC to just over 200 BTC, according to Blockstream’s proof-of-reserves data.
2
SideSwap said a customer submitted 4,000 L-BTC to its peg-out service at 14:05 UTC; the L-BTC was burned with a valid authorization, and the federation paid 3,996 BTC to the customer’s Bitcoin address at 14:28 UTC.
3
Preliminary accounts said Liquid’s hardware security modules signed the withdrawal because the transaction complied with the sidechain’s consensus rules, rather than because the federation’s cryptographic keys had been directly compromised.
4
The bitcoin was moved to an address ending in “6gyqjlte,” where it reportedly remained at the time of publication after the address posted the message, “we are whitehats. contact us on chain.”
5
A small transaction apparently linked to Blockstream later sent an on-chain message to the recipient address saying, “Please contact security@blockstream.com,” although the source noted that the transaction’s connection to Blockstream was not confirmed.
Blockstream's Liquid Network halted operations after attackers withdrew approximately 4,000 BTC—worth about $320 million—from the sidechain's federation wallet on January 2025. Technadu reported the theft drained 95% of Liquid's bitcoin reserves, leaving just over 200 BTC backing the L-BTC token. The perpetrators left an on-chain message claiming to be 'white hats,' but their identity and intentions remain unknown.
Tronweekly said a preliminary investigation points to an inflation bug in Elements software that allowed counterfeit L-BTC to be created and redeemed for real bitcoin. The transaction passed Liquid's security checks, and the federation's 11-of-15 multisignature structure approved the payout. Exchanges immediately halted L-BTC deposits and withdrawals, though other assets on the network remained unaffected.
How 4,000 Bitcoin Left Liquid's Wallet
Cointribune reported that a customer submitted 4,000 L-BTC to SideSwap's peg-out service at 14:05 UTC. The sidechain burned the L-BTC with what appeared to be valid authorization. Minutes later, at 14:28 UTC, Liquid's federation paid 3,996 BTC to the customer's bitcoin address. The transaction looked legitimate to the network's consensus rules and security modules.
Altcoinbuzz noted Liquid's hardware security modules signed off on the withdrawal without detecting fraud. The federation's 11-of-15 multisig structure approved the payout because the transaction technically complied with sidechain rules. This suggests an infrastructure vulnerability, not a compromised cryptographic key.
'White Hats' Move Funds to Single Address
The 3,996 BTC was sent to an address ending in '6gyqjlte,' where it remained as of publication. LCX reported the recipient posted an on-chain message: 'we are whitehats. contact us on chain.' However, their true identity, motive and whether they plan to return the funds have not been verified.
Altcoinbuzz said a small transaction apparently linked to Blockstream later sent a follow-up message to the recipient address directing them to contact security@blockstream.com. However, the connection to Blockstream could not be independently confirmed at the time.
Liquid Pauses Bridge While Investigation Continues
Technadu reported Blockstream disabled Liquid's bridge nodes, blocking new transfers between the sidechain and Bitcoin mainnet. Cryptocurrency exchanges including Kraken and Bitstamp halted all L-BTC deposits and withdrawals. The network remains paused pending resolution.
Cointribune confirmed that other assets issued on Liquid—including USDT stablecoins, DePix tokens, and real-world asset offerings—were reported unaffected by the exploit. The incident specifically targeted the federation's bitcoin peg-in reserves, not other token systems on the sidechain.
Sentiment
Mostly NegativeNEGATIVENEUTRALPOSITIVE
Publishers
44
Articles
22
Reach
66
A
AnonymousAuthor
