Liquid Network Attacker Returns 3,400 Bitcoin, or 85% of Stolen Funds

An attacker who drained about 4,000 Bitcoin from the Bitcoin sidechain Liquid Network has returned about 85% of the stolen funds after a security flaw was patched.

The attacker, who described himself as a white-hat hacker, discussed the terms of the return with Blockstream, Liquid’s technology provider, via Bitcoin OP_RETURN messages and PGP-encrypted messages, The Block reported on September 7.

The attacker told Blockstream to fix the bug first and indicated the funds would be returned once all bridge nodes had been patched. Blockstream later posted an on-chain message saying the bridge nodes had been patched and the funds could be returned safely.

The attacker then sent 3,400 BTC back to a Liquid Federation address, equal to 85% of the roughly 4,000 BTC originally taken. The attacker’s wallet still holds about 598.5 BTC, worth about $47.3 million.

The incident began on September 6, when about 4,000 BTC was withdrawn from a Liquid Federation wallet. SideSwap said 4,000 LBTC was sent to the peg-out service during the attack and then burned after passing the normal approval process. Liquid Federation later paid out 3,996 BTC to the attacker’s Bitcoin address.

Blockstream later determined that the LBTC used in the attack had been minted through a bug in Elements, the software underlying Liquid. SideSwap said its own systems and peg-out approval keys were not compromised.

Liquid disabled bridge nodes and halted network activity immediately after the incident. Exchanges have also suspended LBTC deposits and withdrawals. SideSwap plans to keep swaps and peg-in and peg-out services suspended until the network resumes.