cyber.hendryadrian.com
Cyber Attack & Data Breach · chainalysis.com

Liquid Network Exploit Drains $320 Million in Bitcoin; 85% Returned

· Original article ↗

Summary

Attackers exploited Liquid Network’s transaction-validation flaw to create unbacked L-BTC and withdraw about $320 million in BTC. They returned 85%; Blockstream patched the bug, while roughly $47 million remained with the actors.

Key points

  • Attackers exploited a flaw in Liquid’s transaction-validation software to create L-BTC without depositing the BTC that should back it.
  • The unbacked tokens were exchanged for roughly 4,000 BTC—about $320 million—from Liquid’s reserve.
  • The flaw involved cached cryptographic verification results: invalid transaction data could be mistaken for previously approved data.
  • The actors described themselves as white hats and communicated with Blockstream through Bitcoin transactions.
  • They returned 3,400 BTC, about 85% of the amount withdrawn; roughly 600 BTC, worth about $47 million at the time, remained under their control.
  • Blockstream deployed updated software and was preparing the network for a restart.

Article Details

Victim Organization
Liquid Network
Incident Type
Exploitation of a transaction-validation vulnerability to create unbacked L-BTC and withdraw BTC from the network's reserve
Operational Impact
Approximately 4,000 BTC were withdrawn from Liquid Network's reserve. Blockstream deployed updated software and was preparing the network for a restart.
Ransom Or Extortion
None reported. The purported white-hat hackers returned 3,400 BTC; approximately 600 BTC remained under their control. A possible bounty was speculation and was not publicly confirmed.
Claim Status
confirmed

Vendors

BlockstreamAe actors returned 85% of the withdrawn BTC, while Blockstream deployed updated software to address the vulnerability.

Products

BitcoinOver the weekend, a group of purported white-hat hackers exploited Liquid Network with a heist that should not have been possible: they withdrew $320 million in real bitcoin (BTC) — essentially for free.L-BTCA vulnerability in Liquid’s transaction-validation software allowed the hackers to create unbacked L-BTC tokens and exchange them for real BTC.Liquid NetworkPurported white-hat hackers exploited the Liquid Network to withdraw $320 million in BTC from the network’s reserve.

Related Articles