Roughly 4,000 BTC Drained From Liquid Network; Attacker Claims Most Will Be Returned After Patch
Liquid Network saw an anomalous withdrawal of roughly 4,000 BTC — worth about $320 million at the time — over the weekend. An attacker claiming to be a white hat demanded a vulnerability patch before returning the funds. Blockstream has responded with a signed on-chain message, but as of this report, the funds have not yet been returned.
Handing your assets over to a system you can't see into, the scariest part isn't price swings — it's the system suddenly proving it can fail too. Bitcoin sidechain Liquid Network suffered an incident over the weekend in which roughly 4,000 BTC, worth about $320 million at the time, was moved out of its federation wallet. The attacker later stated they'd be willing to return the majority of the funds once the software vulnerability is patched.
This promise wasn't delivered via a customer service email — it was written directly on-chain. According to The Block, the attacker, claiming to be a white hat, communicated with Blockstream using the OP_RETURN field of Bitcoin transactions along with PGP-encrypted text, leaving a demand at block 965,875: fix the vulnerability, confirm that all nodes have been updated, and only then discuss returning the funds.
Blockstream subsequently responded with a PGP-signed on-chain message stating that the bridge nodes had been patched and the funds could be returned; the signature can be verified against the security key published on Blockstream's official website. However, as of publication, roughly 4,000 BTC remained in the attacker's wallet. "Will return" is still an unfulfilled promise, not a completed outcome.
The technical path behind the incident is also more complex than a simple "stolen private key" scenario. According to SideSwap, the transaction in question involved 4,000 L-BTC being sent into its peg-out service, which used a valid authorization to burn the tokens. The Liquid Federation then paid out 3,996 BTC to the corresponding Bitcoin address. SideSwap says its own system and peg-out authorization keys were not compromised, and Blockstream has since confirmed the issue stemmed from a vulnerability in the Elements software.
Liquid has suspended network activity, disabled its bridge nodes, and asked exchanges to pause LBTC deposits and withdrawals. SideSwap has stated that swaps, peg-ins, and peg-outs will remain paused until the network is restored. For users, this means the fallout isn't confined to the attacker's wallet — it also extends to the availability of normal fund transfers.
The most uncomfortable part of this whole saga is that the technical patch and the return of funds are bundled together in the same negotiation. Node updates being completed is verifiable engineering progress; whether the attacker actually returns the majority of the BTC is an entirely separate matter. Until an on-chain transfer actually happens, any promise should be treated as unconfirmed.
