The Liquid Network has been effectively shut down following a security incident involving roughly 4,000 Bitcoin worth about $320 million.
In a statement posted Sunday, Liquid Network said purported white-hat hackers withdrew approximately 4,000 BTC from the Liquid Federation wallet. The Blockstream team is now attempting to contact the hackers on-chain using a signed message.
Liquid says the funds were withdrawn through the SideSwap PAK, or Peg-out Authorization Key. Interestingly, the organization says the key itself was not compromised, nor were any other keys.
That leaves a pretty important question unanswered: If the keys were not compromised, how did someone manage to withdraw approximately $320 million worth of Bitcoin?
For now, Liquid and its federation members appear to be treating the situation seriously. Exchanges have been notified and have either paused or are expected to pause LBTC deposits and withdrawals.
Other assets on Liquid, including USDT, DePix, and real-world assets, are said to be unaffected by the security incident.
The bigger immediate problem is that Liquid has essentially stopped operating. Bridge nodes have been temporarily disabled, preventing new transactions from being submitted to the network.
“Effectively, the Liquid sidechain is paused until this issue is resolved,” Liquid Network said.
Liquid also warned that wallets will be impacted while federation members work to restore normal network activity.
The people behind the withdrawal are being described as purported white-hat hackers, which is an important qualifier. Calling this a $320 million theft would be premature. White-hat hackers typically discover or exploit vulnerabilities with the intention of reporting them rather than stealing funds.
Still, moving approximately 4,000 BTC out of a federation wallet is an extraordinary way to demonstrate that something may be wrong.
The incident also puts fresh attention on Liquid’s architecture. Liquid is a Bitcoin sidechain designed to provide faster and more confidential transactions, along with the ability to issue assets. Unlike Bitcoin itself, Liquid relies on a federation to operate parts of the network, including its peg between BTC and LBTC.
For anyone holding or using LBTC, the most important development right now is simple: Liquid is paused.
Liquid has directed users to monitor the relevant Bitcoin address through mempool.space while the investigation continues. The company has not yet provided a detailed technical explanation for how the withdrawal was possible without the Peg-out Authorization Key being compromised.
Until that explanation arrives, there are far more questions than answers. The hackers may ultimately prove to be exactly what they claim: white hats exposing a vulnerability. But when someone can move around $320 million worth of Bitcoin and the response is to effectively shut down the network, Liquid and Blockstream have some serious explaining to do.
Support independent tech journalism
NERDS.xyz is independently owned and operated. If you enjoy my coverage of Linux, AI, hardware, cybersecurity, and tech culture, consider supporting the site on Ko-fi.
Support NERDS.xyz