Hackers Return Most of Stolen Liquid Network Bitcoin, 598 BTC Still Missing
Liquid Network halted transactions after hackers stole 3,998 BTC. They returned 3,400 BTC after a patch, but 598 BTC worth $47M is still missing, and the network remains paused.
The exploitation used SideSwap, a service that converts between bitcoin and Liquid Bitcoin (L-BTC). The attackers generated roughly 4,000 L-BTC without depositing an equivalent amount of bitcoin, then sent the fake tokens through SideSwap. A bug prevented SideSwap from distinguishing real from fake L-BTC, and the Liquid Federation released 3,998 real BTC to the attackers as a result. Upon discovering the drain, the federation halted new transactions and warned of service interruptions.
The people behind the attack soon communicated with maintainers using messages encoded in bitcoin transactions. They described themselves as white-hat security researchers and said they had taken the funds to keep them safe until a patch was deployed. One message read: 'Please fix the bug first. The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix.'
On Sept. 8, CoinDesk reported that 3,400 BTC had been returned to the Liquid Federation wallet. Samson Mow, former chief strategy officer at Blockstream, confirmed the return on X and said it followed confirmation that affected bridge nodes had been patched. He added that about 598 BTC, worth approximately $47 million, remains outstanding and that Blockstream continues to engage with the hackers. Mow said the network is still paused while Blockstream and federation members make further fixes, resolve a chain split and prepare for a safe restart. He advised users not to send bitcoin to Liquid peg-in addresses until the restart is confirmed.
The Liquid Network is a Bitcoin sidechain built by Blockstream and operated by the Liquid Federation, which includes more than 80 member companies. By moving bitcoin onto the sidechain as L-BTC, users can make faster transfers and issue tokenized assets such as securities and stablecoins. The federation's functionaries — a subset of 15 members — run the network's servers.