The Bitcoin sidechain Liquid under Blockstream has been suspended from operation since Sunday. Approximately 4,000 BTC coins have flowed out of the federal wallet that supports the circulation of L-BTC, which is estimated to be worth about 320 million US dollars at the price mentioned in the text. After the incident, the bridging nodes were shut down.
Funds flow out through the normal redemption process.
According to Liquid and federal member SideSwap, a customer sent 4,000 L-BTC to SideSwap at 14:05 UTC. Subsequently, these tokens were destroyed under valid authorization, and 23 minutes later, the federal wallet completed the redemption of approximately 3,996 BTC.
Liquid indicates that funds were leaked through the peg-out authorization key of SideSwap, but neither this key nor any other federal keys were compromised. SideSwap also claims that its own system was not invaded and points the finger at a software vulnerability in Elements used by Liquid.
The report mentions that Blockstream has not yet made public details about the specific vulnerability. However, the underlying software of Liquid had relevant fixes implemented five weeks ago. According to the information disclosed so far, it is not the case that someone forcibly transferred bitcoins from the wallet; rather, a L-BTC that does not support bitcoins was first generated, and then BTC was exchanged through what appeared to be a normal redemption process.
The balance of the federal wallet has dropped to approximately 200 BTC.
Before the incident, the relevant federal wallet held approximately 4,200 BTC. After the incident, the balance dropped to about 200 BTC, which is about 5% of the previous level.
- Abnormal outflow scale: approximately 4,000 BTC
- Wallet balance after the incident: approximately 200 BTC
- Time difference in fund settlement: approximately 23 minutes
A timeline published by the former Blockstream security officer Samson Mow shows that the relevant address currently holds approximately 3,998.5 BTC.
Claiming to be a white hat in online comments on the blockchain
The party transferring the funds left a message on the blockchain stating, "We are white-hats, please contact us on the blockchain." Subsequently, the Blockstream party responded via an email address provided on the blockchain, and it is claimed that both parties continued to communicate thereafter through PGP signed messages in Bitcoin transactions.
Ledger Chief Technology Officer Charles Guillemet Initially skeptical about the term "white hat," he believed that true white hats would not withdraw bridging funds first before requesting on-chain contact. He later went on to say that nowadays, some so-called white hats refuse to return the funds before fixing the vulnerabilities.
Other assets have not yet been affected.
The information disclosed so far shows that other assets on Liquid, including USDT, DePix and tokenized real-world assets, have not been affected. The Bitcoin mainnet itself has also not been impacted.
This means that the impact of the event is mainly concentrated on the bridging and asset mapping mechanisms of the Liquid sidechain, rather than the Bitcoin network itself.
