Liquid Network attacker returns 3,400 BTC after bug fix, retains nearly 600 BTC

The attacker who withdrew roughly 4,000 BTC from Liquid Network's federation wallet over the weekend has returned around 85% of the funds after Blockstream said its bridge nodes had been patched.

The purported white-hat hacker communicated with Blockstream through Bitcoin OP_RETURN messages and PGP-encrypted text. In a message at block 965,875, the party told Blockstream to "fix the bug first" and ensure every node is patched before they would transfer the funds back.

Adam Back-led Blockstream subsequently sent a PGP-signed onchain message saying, "Bridge nodes are patched, safe to return the funds." The signature verifies against the security key published on Blockstream's website. The attacker then returned 3,400 BTC to the federation address in block 965,950, leaving about 598.5 BTC ($47.3 million) in the attacker's wallet.

The exchange followed an earlier message from the attacker offering to send most of the bitcoin back to the federation address. Blockstream had first contacted the party through a transaction at block 965,822, asking it to contact the company’s security team.

Communication between the parties began after Liquid said on Sept. 6 that roughly 4,000 BTC, then worth about $320 million, had been withdrawn from its federation wallet. The funds were withdrawn through the SideSwap Peg-out Authorization Key, but that key itself was not compromised, according to the network. 

In a statement on X, SideSwap said the affected transaction involved 4,000 LBTC sent to its peg-out service. The service burned the tokens using a valid peg-out authorization, after which the Liquid Federation paid 3,996 BTC to the customer’s Bitcoin address.

Blockstream later established that the LBTC had been created through a bug in the Elements software, according to SideSwap. The trading platform said neither its systems nor its peg-out authorization key had been compromised.

Liquid had paused network activity, with bridge nodes disabled and LBTC deposits and withdrawals suspended at exchanges. SideSwap said swaps, peg-ins, and peg-outs would remain paused until the network resumes.

Updated with additional details throughout.