Blockstream's Liquid Loses $320M Bitcoin to White-Hat Hackers
In brief
- $320 million in Bitcoin withdrawn from Blockstream's Liquid federation wallet on Sunday.
- White-hat hackers exploited Elements software bug to create unbacked L-BTC and cash out.
- Hackers contacted Blockstream via on-chain PGP messages offering conditional fund return.
- Bitcoin network and other Liquid assets like USDT remain unaffected by the incident.
The Withdrawal and Initial Response
Blockstream's Liquid sidechain has been paused since the incident. The federation wallet held around 4,200 BTC before Sunday and roughly 200 after, according to available data. SideSwap, a federation member running a peg-out service, received 4,000 L-BTC from a customer and burned them under valid authorization, with the federation paying out 3,996 BTC 23 minutes later.
Liquid stated that neither the Peg-out Authorization Key nor any other federation key was compromised. SideSwap reported that none of its systems were breached either, and pointed to a bug in Elements, the software Liquid runs on. The critical detail: a fix for it was added to Liquid's underlying software five weeks earlier.
On-Chain Negotiation
The party responsible left an on-chain message: "we are whitehats. contact us on chain." Blockstream answered an hour later with an email address, and the two have traded PGP-signed messages inside Bitcoin transactions since.
This is unusual. The hackers offered to send most of the coins back, then attached a condition: patch the bug first, because the chain is currently vulnerable. Blockstream's reply, "Yes, thank you," answered the earlier offer, and was confirmed in the same block as the condition.
The White-Hat Debate
Not everyone agrees with the "white-hat" framing. Ledger chief technology officer Charles Guillemet initially argued that "White hats don't drain a bridge and then solicit an 'on-chain' contact". He later hardened his position, stating that white hat practice has changed and that the hackers are stealing money and refusing to return funds before the vulnerability is fixed.
Impact Contained
Other assets on Liquid, including USDT, DePix and tokenized real-world assets, were untouched. Bitcoin's own network is unaffected by the incident. The sidechain remains paused while the negotiation continues.
Frequently asked questions
What happened to Liquid's Bitcoin reserves?
Approximately 4,000 BTC worth roughly $320 million were withdrawn from Blockstream's Liquid federation wallet. The unauthorized party exploited a bug in Elements software to create L-BTC without Bitcoin backing, then cashed it out through a peg-out that appeared ordinary. The federation wallet dropped from around 4,200 BTC to roughly 200 BTC.
How are Blockstream and the hackers communicating?
They're exchanging PGP-signed messages embedded inside Bitcoin transactions. Blockstream responded to an on-chain message from the hackers with an email address, and the two have continued communicating this way since the incident.
What's the hackers' condition for returning the funds?
The hackers offered to return most of the coins on the condition that Blockstream patch the Elements bug first. Blockstream replied 'Yes, thank you' to both the offer and the condition, confirmed in the same blockchain block.
Are these really white-hat hackers?
That's disputed. The party claims white-hat status and is negotiating openly with Blockstream. However, Ledger CTO Charles Guillemet argued that true white hats don't drain a bridge and then solicit on-chain contact, later hardening his stance that the hackers are stealing money.
