Liquid Network Rises from Ashes: Massive Hack Recovery Nears Completion!

The Liquid Network announced its full return to operation, over a month after hackers illicitly obtained 4,000 bitcoin, valued at approximately $320 million at the time. While most of the stolen funds were eventually returned in an operation described by some as “white hat,” the network has been focusing on recovery, stating it is now in its “final stages of recovery with enhanced security.” This marks a significant step for the Blockstream sidechain, which had been negotiating the return of the funds since the September incident.

The hack involved the exploitation of an inflation bug within the Liquid sidechain. Hackers used this vulnerability to create over 4,000 LBTC tokens, which were not backed by actual bitcoin, and then managed to cash them out for real on-chain BTC. The stolen bitcoins originated from the network’s federation wallet, which backs the Blockstream sidechain. Following extensive work by the Federation, Blockstream, and independent security experts, crucial technical infrastructure and safeguards have been put in place.

As part of the restoration, the Liquid Network has reestablished its full 1:1 bitcoin backing. This has been followed by the controlled reactivation of Federation peg-outs for authorized PAK key holders. Adam Back, CEO of Blockstream, confirmed on X that LBTC:BTC swaps are now fully functional again, allowing users to swap LBTC to/from mainchain BTC on SideSwap and to/from Lightning on Aqua Bitcoin. The network has also reintroduced phased swaps, indicating a gradual and secure return to full service.

Despite the return of most funds, the hackers’ claim of being “white hat” has faced criticism, primarily because they retained approximately 15% of the stolen bitcoins. This amounts to about 600 bitcoins, currently valued at close to $50 million. The hackers engaged in an exchange with Blockstream, embedding messages into Bitcoin blocks. In one such message, they harshly criticized Blockstream, calling the company “delusional, greedy, and arrogant.”

Further complicating the situation, the hackers issued a threat, stating they would reveal all of Blockstream’s encrypted messages from their exchange unless the company paid them a 10% bug bounty. They explicitly demanded, “You SHALL pay 10% using your own money as bug bounty or you will cause all your holders a 15% loss for your irresponsibility and stinginess.” It remains publicly unknown whether Blockstream ultimately reached a private settlement with the hackers regarding their demands or the retained funds.