Liquid Network’s $320 Billion Hack Raises Questions Over Bitcoin Sidechain Security

Liquid Network, a settlement ​network used by cryptocurrency exchanges, has reported withdrawal of Bitcoin worth $320 million from its wallet ​in a hacking incident. The Liquid Network hack was allegedly conducted by a white-hat hacker. The hacker reportedly intends to return the stolen funds once Liquid Network fixes the vulnerability. The incident occurred as Bitcoin price surges following renewed investor demand.

How Much Was Withdrawn in the Liquid Network Hacking Incident? 

In a post published on X, Liquid network said “purported white-hat hackers” withdrew about 4,000 of the 4,200 Bitcoins held in its federation wallet. Liquid Network, a Bitcoin-based payments and settlement network, is governed by a federation of more than 80 exchanges, infrastructure providers, and asset managers.

Following the attack, Liquid Network suspended new transactions and cautioned that its wallets would be impacted as federation members work to restore operations. The network said the incident did not affect other assets held in its wallets.

“Exchanges have been notified and have already paused (or will pause) LBTC deposits and withdrawals. Other Liquid assets such as USDT, DePix, and RWAs are unaffected by this security incident,” Liquid Network noted in the post. 

How Did Hackers Move Bitcoin from Liquid Network Wallets? 

Instead of compromising passwords or private keys, the attackers reportedly used a legitimate and approved trading platform called SideSwap to exploit Liquid Network. The platform allowed hackers to move $320 million worth of Bitcoin from Liquid Network’s federation wallets through a mechanism that’s used for authorized transactions.

Blockstream, which owns Liquid Network, later discovered that a software bug in a system called Elements had generated some of the Bitcoin involved in the incident. SideSwap said it could not distinguish between the coins created by the bug from the legitimate ones, hence it handled all of them in the same way. 

White hat hackers identify and exploit vulnerabilities in systems to help organizations fix them before malicious actors can take advantage of those weaknesses. In the case of the Bitcoin sidechain hack, security specialists said the flaw was located at the node level in Liquid’s transaction software. 

Reports indicate the hackers have been communicating with Blockstream through on-chain Bitcoin transactions. In one of the messages published by Coindesk, they said, “Please fix the bug first. The chain is under risk at least commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix.”

Why Does the Liquid Network Bitcoin Hack Matter? 

Liquid Network was launched by Blockstream in 2018 to address the slow transaction settlement challenge in the Bitcoin blockchain. The network helps exchanges move and settle bitcoin faster by issuing L-BTC against bitcoin locked in reserve. The loss of nearly the entire reserve in this incident raises serious doubts about the security and resilience of this model.

Liquid Network has not stated whether the stolen Bitcoin will be recovered or when operations will resume. The hacking incident comes days after hackers stole $6 million from a lending platform linked to Crypto.com. It also follows an August incident involving the Bitcoin hardware wallet, Coldcard.