Hackers drain $320M in Bitcoin from Liquid Network, claim they're the good guys

Hackers have siphoned approximately $320 million worth of Bitcoin from the Liquid Network's federation wallet, declaring themselves as good-intentioned "whitehats." The Liquid Network, a Bitcoin sidechain developed by Blockstream utilized by exchanges and financial institutions, disclosed on X that around 4,000 BTC were withdrawn from its federation wallet by a group they described cautiously as "purported white-hat hackers."

The wallet held roughly 4,200 BTC prior to the incident, indicating the hackers removed nearly 95 percent of the holdings. Liquid subsequently disabled its bridge nodes, prompting federation members to investigate and exchanges to suspend L-BTC deposits and withdrawals. The entities behind the withdrawal identified themselves as "whitehats" within a Bitcoin transaction, seeking contact from Blockstream.

Blockstream responded through an on-chain message, providing the security team's contact details, after which the parties switched to encrypted communications. The hackers claimed they would return most of the Bitcoin once the vulnerability was rectified and Liquid's nodes updated. The exact method of moving almost the entire federation wallet remains under investigation.

Although the BTC was withdrawn via SideSwap using the Peg-out Authorization Key (PAK), neither SideSwap's key nor any other PAK appeared compromised. This raises questions about how an authorized SideSwap peg-out led to the near-emptying of the federation wallet. The incident underscores that adding Bitcoin to a system doesn't automatically guarantee its security.

Liquid functions as a federated sidechain where members collectively manage the Bitcoin backing L-BTC, rather than relying on Bitcoin miners for security. For now, the stolen funds are in the hands of individuals claiming to conduct security research, and the fate of the 4,000 BTC remains uncertain.