A blockchain utilised by multiple cryptocurrency exchanges for Bitcoin transactions has been compromised, resulting in a loss of $320 million. This incident marks the latest in a series of breaches that have undermined confidence in the security of digital assets. Approximately 4,000 of the 4,200 Bitcoin contained in a wallet associated with the Liquid Network were reportedly withdrawn, according to a statement from the platform operator on X. It was noted that the perpetrators seem to be “white-hat hackers” who take advantage of security vulnerabilities and generally restore the funds, occasionally in return for a fee. “Liquid wallets will be impacted, and we’re sorry for any inconvenience,” Liquid Network wrote, adding it has halted all new transactions. “Federation members are actively working on resolving this so we can restore normal network activity.”
Alex Thorn stated in a post on X late Monday London time that the hackers had returned 3,400 Bitcoin, apparently retaining approximately $47 million worth for themselves. The hack represents the most recent incident in a series of attacks that have drawn attention to the vulnerabilities within cryptocurrency cybersecurity. Just last week, an attacker syphoned off $6 million from a digital-asset lending platform associated with Crypto.com. In August, a breach of the widely used offline Bitcoin wallet Coldcard prompted a reevaluation of the most secure methods for storing the digital asset. “While these events may understandably shake consumer confidence, they highlight where critical infrastructure safeguards need to be strengthened, and why comprehensive security across the full stack is essential for operators,” said Ziqing Ang.
Liquid Network was initiated in 2018 by Blockstream Corp., a blockchain technology firm co-founded by cryptographer-turned-Bitcoin advocate Adam Back. According to Blockstream, it is currently overseen by a federation comprising over 80 exchanges, infrastructure firms, and asset managers. Liquid Network and Blockstream failed to provide a response to emailed enquiries for comment. In its post on X, Liquid Network stated that the funds were withdrawn through SideSwap, a settlement platform authorised to manage transfers from the network, while confirming that the key remained uncompromised. In the aftermath of Liquid Network’s announcement regarding the hack, communications seemingly exchanged between the hackers and Blockstream were observed embedded within minor Bitcoin transactions, as indicated by data from the blockchain tracker Mempool. The hackers indicated that they would restore the funds following the verification that the vulnerability had been addressed.
Liquid functions as a sidechain, a distinct network utilised by exchanges for rapid settlement, as the primary Bitcoin blockchain frequently experiences delays and high costs associated with transactions due to network congestion. Liquid Network accelerates this process by issuing Liquid Bitcoin, or L-BTC, in exchange for actual Bitcoin, which it secures through locking. Blockstream identifies multiple prominent exchanges as participants in Liquid, including BTSE and Bitfinex, the latter of which is affiliated with Tether, the leading issuer of stablecoins globally. BitMEX, which has announced its impending closure this month, was also a participant. Aneirin Flynn, chief executive of cybersecurity technology firm FailSafe, stated that preliminary evidence indicates a bug that permits the minting of L-BTC. The breach “is the latest in a spate of attacks exposing weaknesses in crypto infrastructure this year,” Flynn stated.
