The Cryptocurrency Post The CryptocurrencyPost
AboutContact
Security

Liquid Network hit by $320M exploit, actors return 85% claiming white-hat role

Photorealistic header: BTC draining from Liquid Network federation wallet with red alert glow and white-hat operator.

Liquid Network said a compromise involving its federation wallet led to the withdrawal of roughly 4,000 BTC, a move valued at about $320 million at the time, before the actors behind it later returned most of the funds. Blockstream’s official media post on the incident said 3,400 BTC, or about 85% of the total drained, had been sent back by parties describing themselves as white hats.

The return leaves about 600 BTC still associated with the withdrawal, according to the reporting and on-chain figures cited in the coverage. The incident affected the federation wallet backing Liquid, a Bitcoin sidechain operated by Blockstream, rather than Bitcoin’s base layer.

Funds moved out of the federation wallet before the return

Coverage of the incident said the wallet held roughly 4,200 BTC before the withdrawal and that about 4,000 BTC were moved out in the exploit. Liquid subsequently disabled its bridge nodes while federation members investigated and asked exchanges to suspend L-BTC deposits and withdrawals, according to reporting that cited the network’s public updates.

The actors behind the withdrawal also left messages on the Bitcoin blockchain identifying themselves as white hats and saying they wanted to work with Blockstream. The company later responded on-chain with security contact details, and the parties moved their communication to encrypted channels, according to the reporting.

Return came with a request to patch the bug first

The on-chain messages quoted in the coverage indicated that the actors planned to return most of the Bitcoin after the vulnerability was fixed and the nodes were updated. One message said the chain was “under risk” at the latest commit and asked the team to patch every node before the funds were transferred back.

Blockstream has not, in the material provided, said the incident is fully resolved. The available reporting indicates the returned funds account for most of the drained Bitcoin, but not all of it.