Individuals identifying themselves as white-hat hackers removed approximately 4,000 Bitcoin — valued at $320 million — from the Liquid federation wallet, prompting the sidechain to halt all operations.
Liquid announced on Sunday that it had disabled bridge nodes, blocking fresh transactions from processing. Trading venues either stopped or began preparations to stop deposits and withdrawals of L-BTC in response to the incident.
Blockstream, which provides the technology infrastructure for Liquid, initiated communication with the individuals via signed onchain messages. The messages reveal that the actors instructed Blockstream to repair the flaw and confirm that all nodes had been upgraded before they would release the majority of the withdrawn Bitcoin.
Encrypted technical information about the vulnerability was transmitted to Blockstream, Galaxy Digital research head Alex Thorn reported. The Bitcoin remained unrecovered at the time of publication.
SideSwap stated that the removal occurred through its peg-out facility as a standard customer request utilising its Peg-out Authorization Key (PAK). The company clarified that the PAK itself was not breached. SideSwap attributed the L-BTC involved in the transfer to a defect in Elements — the open-source codebase on which Liquid operates — rather than any failure within SideSwap's own infrastructure.
The amount taken constituted around 95% of the wallet's total holdings, which stood at roughly 4,200 BTC prior to the withdrawal. Liquid confirmed that other tokens issued on the network, such as USDT, DePix and real-world assets, remained secure and unaffected. Operations stayed frozen as federation participants continued efforts to address and resolve the underlying vulnerability.
Source: cointelegraph.com