Image Credit: blockstream.com
Liquid Network says about 598.5 BTC worth roughly $47 million remains outstanding after the actors behind its Sept. 6 security incident returned most of the Bitcoin withdrawn from the sidechain. Blockstream is continuing discussions with the self-described white-hat actors as Liquid works to recover the remaining funds and restore normal network operations.
Nearly 600 BTC Remains Outstanding
Liquid said the actors returned 3,400 BTC to the federation peg wallet on Sept. 7, recovering about 85% of the roughly 4,000 BTC involved. The remaining 598.5 BTC represents about 15% of the original amount and was valued near $47 million in Liquid’s Sept. 8 update.
Liquid has not disclosed the terms of the continuing discussions or whether the remaining Bitcoin is being considered as part of a potential bounty. The actors’ description of themselves as white-hat security researchers also remains self-reported rather than independently established. Liquid Network said:
“Discussions between Blockstream and the individuals responsible are ongoing to secure the return of the remaining funds.”
3,400 BTC Returned After Blockstream Patched Bridge Nodes
An address associated with the self-described white-hat actors transferred exactly 3,400 BTC back on Sept. 7 in Bitcoin block 965,950. The return came after Blockstream told the actors through a signed on-chain message that Liquid’s bridge nodes had been patched, and the funds were safe to return.
Blockstream completed the bridge-node patch at 01:09 UTC on Sept. 7, according to Liquid’s incident report. Liquid said the change was intended to prevent the vulnerability from being exploited again through those nodes.
Elements Bug Allowed Unbacked L-BTC
Liquid said the incident resulted from a vulnerability in Elements, the open-source software underlying the sidechain. The flaw involved how nodes cached range-proof verifications and allowed invalid L-BTC to be accepted before a peg-out was initiated.
SideSwap subsequently processed a peg-out involving 4,000 L-BTC, which led the Liquid Federation to release roughly 4,000 BTC. Liquid said federation functionaries were not hacked, and no private keys were compromised, while the peg-out authorization system itself operated as designed.
Liquid Prepares Emergency Update and Restart
Liquid remained offline in its Sept. 8 incident update while developers reviewed security fixes and network restoration code. Blockstream was preparing an emergency Elements v23.3.4 release, with additional adjustments required before full functionality could resume.
Liquid said the restoration process will include correcting the sidechain state to exclude the effects of the invalid L-BTC and associated peg-out. Blockstream is continuing discussions with the actors while Liquid works to restore 1:1 Bitcoin backing for L-BTC and recover the remaining funds.
