Nearly 95% of the Bitcoin held in Liquid Network’s federation wallet was removed through a withdrawal process that its operator says used a valid authorization key that had not been compromised, shifting the focus of the $320 million incident from stolen credentials to a failure in the software governing what could be redeemed.
Around 4,000 BTC left a wallet that held roughly 4,200 BTC, according to Liquid, Reuters reports. The Bitcoin sidechain subsequently disabled its bridge nodes, effectively pausing new transactions, while exchanges were asked to suspend L-BTC deposits and withdrawals.
The transaction was processed through SideSwap, a Liquid Federation member that provides peg-out services. SideSwap said a customer delivered 4,000 L-BTC on September 6. The service burned those tokens using a valid peg-out authorization.
Sponsored · Altamira Gold Corp.
The unusual part came before the withdrawal. SideSwap said Blockstream later determined that the L-BTC submitted to its service had been created through a bug in Elements, the open-source software underlying Liquid, The Block reports. SideSwap said it could not distinguish the affected L-BTC from legitimate tokens and that neither its systems nor its Peg-out Authorization Key had been compromised.
That distinction matters because L-BTC is designed to represent Bitcoin held one-for-one on the main chain. Under normal operation, BTC is locked to create L-BTC, while a peg-out burns L-BTC before the federation releases the corresponding Bitcoin.
In this case, the reported software bug meant the withdrawal process could receive L-BTC that SideSwap says had been created without corresponding Bitcoin backing, then treat those tokens as valid for redemption.
The actors later consolidated the Bitcoin and attached an on-chain message reading, “we are whitehats. contact us on chain.” Blockstream responded through Bitcoin transactions and began communicating with the unidentified party.
The group has since said it will return “most” of the funds once the vulnerability is fixed across the network. Blockstream later sent a signed message saying its bridge nodes had been patched and that it was safe to return the Bitcoin. At the latest verified update, the funds remained in the receiving wallet.
Liquid said other assets issued on the sidechain, including USDT, DePix, and tokenized real-world assets, were unaffected. Bitcoin’s base network also continued operating normally.
