The Liquid Network announced on Tuesday that its systems are up and running again, marking a major milestone over a month after hackers made off with 4,000 bitcoin—valued at approximately $320 million at the time of the incident—from the network’s federation wallet. The vast majority of the funds were subsequently returned in what was framed as a "white hat" operation, though the aftermath has left lingering questions regarding negotiations and the ethical boundaries of the attackers.
In a comprehensive blog post published on Tuesday, the Liquid Network stated that it is officially entering "the final stages of recovery with enhanced security." The security breach, which occurred in September, targeted the federation wallet backing the Blockstream-developed sidechain. While the initial theft sent shockwaves through the Bitcoin layer-2 ecosystem, Blockstream was eventually able to negotiate the return of the lion’s share of the stolen cryptocurrency.
Outlining the steps required to bring the infrastructure fully back online, the Liquid blog post explained that the final phase of restoration involves reestablishing the network’s full 1:1 bitcoin backing. This crucial step is being followed by the controlled reactivation of Federation peg-outs for authorized PAK key holders. According to the network update, the Federation, Blockstream, and independent security experts have made substantial progress toward this objective, ensuring that the necessary technical infrastructure and security safeguards are now securely in place.
Further signaling a return to normalcy, the network has reintroduced phased swaps. Blockstream CEO Adam Back took to social media platform X on Tuesday to confirm that swaps were functioning properly once again, providing reassurance to users and stakeholders who have been awaiting full restoration of services.
For context, Liquid is a prominent layer-2 network created by Blockstream that allows users to quickly move assets backed 1:1 with bitcoin. The sidechain ecosystem enables participants to seamlessly swap stablecoins for bitcoin, as well as interact with bitcoin on the Lightning Network through various applications that support the Liquid Network infrastructure.
The September security breach occurred when hackers successfully exploited an inflation bug on the Liquid sidechain. This vulnerability allowed the attackers to manufacture over 4,000 LBTC—a token supposedly backed 1:1 by bitcoin—that did not exist prior to the exploit, and subsequently cash them out for real on-chain BTC.
The situation took a dramatic turn when the individuals behind the exploit claimed to be white hat hackers. A peculiar and tense communication channel opened between the hackers and Blockstream via messages permanently inscribed directly into Bitcoin blocks, creating a public ledger of their negotiations. However, the designation of "white hat" has been heavily contested by critics and observers. The primary point of contention is that the hackers kept 15% of the stolen funds, an amount worth tens of millions of dollars, rather than returning the entire cache.
The on-chain correspondence revealed a contentious dynamic between the exploiters and the company. In one notable message, the hackers slammed Blockstream as "delusional, greedy, and arrogant." They went on to issue stark threats, stating that they would release all of Blockstream’s encrypted messages from their exchange unless the company agreed to pay them an additional 10% of the bitcoins as an official bug bounty.
The message explicitly demanded that Blockstream pay out of its own pocket, warning that failure to do so would cause all network token holders to suffer a 15% loss due to what the hackers characterized as the company’s irresponsibility and stinginess.
Public records and available blockchain data indicate that the hackers are still holding onto approximately 600 bitcoins, representing 15% of the total funds stolen during the exploit. At current market prices, these retained funds are close to $50 million. At this time, it remains unclear whether Blockstream ultimately reached a private settlement with the hackers behind the closed doors of ongoing negotiations, or if the remaining funds represent an unresolved dispute from one of the most high-profile security incidents in the history of the Bitcoin sidechain ecosystem.
Leave a Reply