Liquid Network attacker says they will return most of 4,000 BTC after bug fix

The attacker who withdrew roughly 4,000 BTC from Liquid Network's federation wallet over the weekend said they would return most of the funds after confirming a fix for the underlying software vulnerability.

The purported white-hat hacker communicated with Blockstream through Bitcoin OP_RETURN messages and PGP-encrypted text. In a message at block 965,875, the party told Blockstream to “fix the bug first” and ensure every node is patched before transferring the funds back.

Adam Back-led Blockstream subsequently sent a PGP-signed onchain message saying, “Bridge nodes are patched, safe to return the funds.” The signature verifies against the security key published on Blockstream’s website. The roughly 4,000 BTC remained in the attacker’s wallet at the time of publication.

The exchange followed an earlier message from the attacker offering to send most of the bitcoin back to the federation address. Blockstream had first contacted the party through a transaction at block 965,822, asking it to contact the company’s security team.

Communication between the parties began after Liquid said on Sept. 6 that roughly 4,000 BTC, then worth about $320 million, had been withdrawn from its federation wallet. The funds were withdrawn through the SideSwap Peg-out Authorization Key, but that key itself was not compromised, according to the network. 

In a statement on X, SideSwap said the affected transaction involved 4,000 L-BTC sent to its peg-out service. The service burned the tokens using a valid peg-out authorization, after which the Liquid Federation paid 3,996 BTC to the customer’s Bitcoin address.

Blockstream later established that the L-BTC had been created through a bug in the Elements software, according to SideSwap. The trading platform said neither its systems nor its peg-out authorization key had been compromised.

Meanwhile, Liquid has paused network activity, with bridge nodes disabled and LBTC deposits and withdrawals suspended at exchanges. SideSwap said swaps, peg-ins, and peg-outs remain paused until the network resumes.