Alleged White-Hat Hackers Withdraw 4,000 Bitcoin from Liquid Network Federation Reserves

According to Bitcoin Magazine reporting by Juan Galt, the Liquid Network stated that purported white-hat hackers withdrew about 4,000 bitcoin, valued at approximately $320 million, from the federation wallet backing L-BTC. Bridge nodes were disabled, and the sidechain was paused, while other issued assets including USDT, DePix, and RWAs remained unaffected.

Before the incident, the treasury held over 4,200 BTC, leaving a little over 207 BTC according to Blockstream's proof of reserves page. The hackers executed a peg-out transaction using the SideSwap Peg-out Authorization Key. Reports indicate an inflation bug on the L-BTC sidechain may have been exploited to create over 4,000 L-BTC before cashing them out for on-chain bitcoin.

The federation members' hardware security module servers signed the withdrawal transaction because it appeared valid under the consensus bug. The funds were moved to an address where a message was signed via an OP_RETURN data field claiming the actors are whitehats. In response, exchanges were instructed to pause L-BTC deposits and withdrawals, and bridge nodes were paused while the sidechain continued producing blocks. LBTC savings are currently at risk since underlying BTC is not redeemable.