Liquid Network Recovers 3,400 of 4,000 Bitcoin After Attackers Forced a Patch First

A party that describes itself as white-hat returned 3,400 bitcoin to the federation wallet of Blockstream's Liquid Network on Monday, after taking about 4,000 bitcoin from the reserves that back the sidechain's L-BTC token. CoinDesk reported that close to 47 million dollars in bitcoin is still outstanding and that talks over the remainder continue. Bitcoin Magazine put the retained amount at 598.5 bitcoin, returned only after Blockstream said the bridge nodes had been patched.

The mechanism matters more than the amount. Liquid is a Bitcoin sidechain whose peg is operated by a federation of functionaries rather than by a single custodian. According to reporting on the incident, a flaw in the Elements software that runs the sidechain allowed the creation of invalid L-BTC, which was then redeemed for real bitcoin through the ordinary peg-out path. The federation's signing keys were not stolen. The authorization layer did exactly what it was built to do, and it did so on the strength of an accounting entry that should never have existed.

The negotiation was itself conducted on-chain. The attackers said they would return the funds once every affected node was patched, and Blockstream answered with a signed message stating that the bridge nodes were fixed and the funds were safe to return, according to Cointelegraph's account of the exchange. Liquid had disabled bridge nodes and paused the peg after the withdrawals were detected.

Two readings of the retained 598.5 bitcoin are circulating. The attackers present it as a bounty proportionate to the severity of the bug they surfaced. Liquid users can point out that no published bounty program authorized a self-assessed fee taken from reserves that back a circulating token. Neither side has disclosed an agreement, and no attribution to a named actor has been made public.