Key highlights:

  • Liquid Network has faced a possible security incident as 4,000 BTC was moved to a new wallet. 
  • The attackers claim to be “white-hat hackers,” leaving their intention unknown. 
  • The network has paused its operations after the incident, but hasn't provided an explanation.

Liquid Network, an open-source Bitcoin layer-2 chain, has paused its operations after a $320 million suspected exploit. The network’s Federation wallet reportedly lost about 4,000 BTC in the incident. While the incident is suspected to be an exploit, the attackers are claiming to be “white-hat hackers.”

Liquid Network pauses operations after Bitcoin drain

Blockstream’s Liquid Network took to X today to reveal a possible security breach involving the platform. The incident resulted in the loss of about 4,000 BTC, worth $320 million, sparking speculation about an exploit.

Notably, the first move took place at around 14:06 UTC, when around 3,996 BTC was transferred to a previously unused wallet. This represented a massive 95% of the Bitcoin held by Liquid Network’s Federation wallet. After some hours, the funds saw another movement, with the sender paying 269 satoshis, or 21 cents, in transaction fees. 

Afterwards, the suspected hacker returned a marginal amount of 0.00001 BTC to Liquid’s own address. But since then, the remaining 3,998.49 BTC has stayed unmoved. This makes the crypto community unsure about the attacker’s motives.

It is worth noting that the attacker included an on-chain message, which read, “we are whitehats. contact us on chain.” The mention of “white hats” could mean that they are moving the funds to expose a security weakness rather than stealing them.

However, as of now, the moved BTC remains under the control of the attacker. It cannot be confirmed whether the hacker has stolen the funds or if it is part of an attempt to address a security vulnerability.

Liquid Network’s Bitcoin reserves still match L-BTC supply

Interestingly, Liquid Network follows a system where Bitcoin can only be withdrawn when the same amount of L-BTC is burned. This mechanism helps keep the Bitcoin reserves and L-BTC supply balanced.

In the latest incident, the numbers appear to match. This is better understood by comparing the remaining BTC reserve and the L-BTC supply, both of which remain almost the same. This indicates that L-BTC holders are still fully backed. The incident hasn’t created any gap between the chain’s reserves and its tokens. The large number of Bitcoin transferred shows that all of the reserves have been used in the withdrawal.

How did the Bitcoin withdrawal happen?

It is still unknown how the Bitcoin withdrawal was approved. According to Liquid Network’s system, only federation members can authorize the burning of L-BTC. This means that the subsequent Bitcoin release also requires approval through the federation’s authorization process. While the federation has 15 members, at least 11 should sign before the BTC can be withdrawn.

Significantly, Liquid Network claims that whitelisted addresses are pre-approved wallet addresses that can receive BTC from the Federation. But in the latest incident, the funds were sent to a new wallet address. Thus, it raises concerns about how the new address was allowed to receive the funds. However, it does not necessarily mean that the whitelist was bypassed or compromised. Regarding this matter, Blockstream hasn’t provided an explanation yet.