The Liquid Network has officially announced that its infrastructure is up and running once again, marking a significant milestone over a month after hackers pulled off a massive heist involving 4,000 bitcoin. At the time of the breach, the stolen funds were valued at approximately $320 million. The incident forced a temporary shutdown of core network functions as developers, security experts, and the underlying federation scrambled to secure the system and negotiate the return of the capital through what ultimately became a contentious, high-stakes recovery operation characterized by the perpetrators as "white hat" activity.
In a comprehensive blog post published on Tuesday, the Liquid Network team revealed that the platform is now entering "the final stages of recovery with enhanced security." The security breach, which unfolded in September, targeted the federation wallet backing the Blockstream-developed sidechain. While the unauthorized withdrawal dealt a severe blow to confidence in the protocol, swift negotiation efforts by Blockstream succeeded in recovering the vast majority of the compromised funds, preventing a total financial catastrophe for users of the layer-2 network.
Detailing the path forward, the Liquid Network blog post explained that the final phase of restoration involves reestablishing the network’s full 1:1 bitcoin backing. This crucial step is to be followed by the controlled reactivation of Federation peg-outs specifically for authorized PAK key holders. According to the network, the Federation, Blockstream, and independent security experts have made substantial progress toward this objective, ensuring that the necessary technical infrastructure and robust safeguards are now fully in place to protect against future vulnerabilities.
Accompanying this system-wide restoration, the platform announced that it has successfully reintroduced phased token swaps. Blockstream CEO Adam Back took to social media on Tuesday to confirm the development, writing on X that swaps were officially operational again. This restoration of core functionality allows users to resume normal trading and transfer operations within the ecosystem, bringing a sense of normalcy back to the developer-driven sidechain.
For context, Liquid is a prominent layer-2 network engineered by Blockstream to facilitate the rapid, confidential movement of digital assets backed 1:1 with bitcoin. The architecture empowers participants to seamlessly swap stablecoins for bitcoin, as well as interact with bitcoin on the Lightning Network via compatible applications. The sidechain relies heavily on a specialized federation model to maintain its peg, making the security of its central federation wallet paramount to the integrity of every token circulating on the network.
The September breach itself was executed through a sophisticated exploit. Hackers managed to weaponize an inflation bug inherent to the Liquid sidechain, allowing them to illicitly mint over 4,000 LBTC—a synthetic token supposedly backed 1:1 by real bitcoin—that simply did not exist prior to the attack. Armed with these newly created tokens, the malicious actors were able to successfully cash them out for real, on-chain BTC, draining the federation reserves and instantly creating a massive deficit that threatened the foundational peg of the entire network.
What followed was an extraordinary digital standoff. The hackers publicly claimed to be white hat operators acting to expose systemic flaws, initiating a surreal public exchange with Blockstream via messages permanently inscribed directly into Bitcoin blocks. However, this self-styled ethical hacking narrative was met with heavy skepticism and sharp criticism from observers, primarily because the actors opted to retain a staggering 15 percent of the stolen funds, an amount worth tens of millions of dollars.
The friction between the company and the hackers escalated during their on-chain negotiations. In one particularly hostile message recorded on the blockchain, the hackers slammed Blockstream as "delusional, greedy, and arrogant." Furthermore, they issued a blunt ultimatum, threatening to leak all of Blockstream’s encrypted messages stemming from their private discussions unless the company agreed to pay the hackers an additional 10 percent of the bitcoins as an official, sanctioned bug bounty.
"You SHALL pay 10% using your own money as bug bounty or you will cause all your holders a 15% loss for your irresponsibility and stinginess," the message read, laying bare the adversarial nature of the communications.
Despite the successful recovery of the bulk of the assets and the resumption of network operations, financial loose ends remain. According to the latest public knowledge, the hackers are still holding onto approximately 600 bitcoins, representing roughly 15 percent of the total funds originally siphoned from the protocol. At current market valuations, this retained portion is worth close to $50 million. At present, it remains entirely unclear whether Blockstream has managed to reach a separate, private settlement with the hackers to recover the remainder of the stolen capital, or if those funds remain permanently out of reach.
Leave a Reply