Blockstream’s Bitcoin sidechain, Liquid, has been suspended since Sunday. Approximately 4,000 BTC, estimated at $320 million based on the price cited in the article, have been withdrawn from the federation wallet backing the circulating L-BTC. Following the incident, the bridge nodes have been shut down.
Funds are withdrawn through the normal redemption process.
According to Liquid and its federation member SideSwap, a customer sent 4,000 L-BTC to SideSwap at 14:05 UTC. Subsequently, these tokens were destroyed under valid authorization, and 23 minutes later, the federation wallet completed the payout of approximately 3,996 BTC.
Liquid stated that funds flowed out via SideSwap’s peg-out authorization key, but neither this key nor any other federation keys were compromised. SideSwap also asserted that its system was not breached and attributed the issue to a vulnerability in the Elements software used by Liquid.
The report states that Blockstream has not yet publicly disclosed specific details of the vulnerability. However, the underlying software of Liquid received the relevant fix five weeks ago. According to the information disclosed so far, no bitcoins were forcibly withdrawn from wallets; instead, L-BTC without underlying bitcoin backing was first created, then exchanged for BTC through what appeared to be a legitimate redemption process.
The federal wallet balance has decreased to approximately 200 BTC.
Before the incident, the relevant federal wallet held approximately 4,200 BTC. After the incident, the balance dropped to approximately 200 BTC, about 5% of the previous level.
- Abnormal outflow volume: approximately 4,000 BTC
- Wallet balance after the event: approximately 200 BTC
- Funding settlement time difference: approximately 23 minutes
A timeline published by Samson Mow, former Head of Security at Blockstream, shows that the relevant address currently holds approximately 3,998.5 BTC.
On-chain comment claiming to be a white hat
The party initiating the fund transfer left a message on-chain stating, "We are white hats; please contact us on-chain." Subsequently, Blockstream responded via the email address provided on-chain, and the two parties allegedly continued communication through PGP-signed messages embedded in Bitcoin transactions.
Ledger’s Chief Technology Officer, Charles Guillemet, initially expressed skepticism about the term "white hat," arguing that genuine white hats would not first drain bridge funds and then request on-chain contact. He further noted that some so-called white hats now refuse to return funds before vulnerabilities are patched.
Other assets have not been affected.
The currently disclosed information indicates that other assets on Liquid, including USDT, DePix, and tokenized real-world assets, have not been affected. The Bitcoin mainnet itself has also remained unaffected.
This means the impact of the event was primarily concentrated on the bridging and asset mapping mechanisms of the Liquid sidechain, rather than the Bitcoin network itself.