Liquid Recovers 3,400 BTC Worth $270M After Security Incident

Liquid has regained control of 3,400 BTC after a weekend security incident drained nearly 4,000 BTC from the Bitcoin sidechain’s reserves.

The recovered coins were worth approximately $270 million at the time and make up about 85% of the Bitcoin removed during the incident. The federation wallet had held around 4,200 BTC beforehand, leaving only a fraction of its previous balance after the withdrawal.

The latest recovery does not account for all of the missing Bitcoin. Samson Mow, a former Blockstream executive and CEO of JAN3, said approximately 598 BTC remained with the actors behind the incident.

According to Mow, the large repayment followed progress in securing the affected infrastructure. Blockstream had confirmed that the necessary patch was in place on the relevant bridge nodes, while communication with the actors continued.

The return also restores most of the Bitcoin reserves lost during the episode. That matters because LBTC circulating on Liquid is designed to maintain verifiable one-for-one backing with BTC secured by the federation on Bitcoin’s mainchain.

Liquid, however, had not immediately resumed normal service. Updated software had been rolled out as federation participants coordinated the work needed to bring the sidechain back into operation.

Details surrounding the incident point to Elements, rather than the theft of a SideSwap authorization credential, as the source of the problem.

The withdrawal passed through SideSwap’s peg-out service using its Peg-out Authorization Key. SideSwap and Liquid maintained that the credential remained secure. SideSwap said the L-BTC involved in the transaction instead stemmed from a vulnerability affecting Elements, the blockchain software on which Liquid is built.

Meanwhile, Blockstream opened a line of communication with the actors by exchanging cryptographically authenticated messages over Bitcoin. The group presented its actions as a security intervention rather than a theft.

Its proposal conditioned the release of most of the BTC on fixing the software flaw across the network. The actors wanted the vulnerability addressed and the relevant node software updated before releasing most of the coins.

Technical work continued even after the repayment. Mow said federation participants were implementing additional security measures and addressing a chain split as part of efforts to resume Liquid operations.

Users were also urged to wait before making new BTC peg-ins. Mow said Bitcoin should not be sent through that route until Liquid’s return to service had been officially confirmed, while indicating that no other action was required from users.

The roughly 600 BTC that was not part of the main repayment has complicated the actors’ characterization of themselves as white hats.

Ledger CTO Charles Guillemet challenged that description, focusing on whether the retained coins might amount to compensation arranged during private blockchain-based communications.

In Guillemet’s view, retaining such a large amount as compensation under those circumstances would blur the line between a legitimate white-hat disclosure and coercion.

However, neither Liquid nor Blockstream has publicly confirmed that the remaining BTC was approved as compensation. Neither organization has announced repayment conditions or an agreed bounty covering those coins.