Current outcome
The Liquid Network remains paused; 3,400 BTC have been confirmed returned to the federation wallet, but the attacker retains approximately 598.5 BTC; redemption access is not restored, Blockstream's status page shows the incident continuing, and full backing and recovery remain unconfirmed.
Progress timeline
7 material updates- #01
- #02
Liquid Sidechain Paused After 3,998 BTC Leaves Federation Wallet
Specified that approximately 3,998 BTC (worth ~$320 million) were withdrawn to a single address, with the recipient writing 'we are whitehats' in the transaction. This nearly depleted the federation wallet's Bitcoin reserves, potentially preventing peg-outs until the funds are returned.
State after update: Liquid Network remains paused after self-identified white-hat hackers withdrew ~3,998 BTC to a single address, leaving the federation wallet's reserves near zero and potentially preventing peg-outs until funds are returned.
Source evidence: The Defiant · blockchain.news · lufkindailynews.com · thestar.com.my · finance.yahoo.com · Binance
- #03
Bitcoin sidechain Liquid pauses after purported ‘white hats’ withdraw $320M in BTC
White-hat hackers contacted Blockstream via on-chain messages, promising to return most of the Bitcoin after the vulnerability is patched and nodes updated; funds have not yet been returned. Additional negotiation details were disclosed.
State after update: Liquid Network remains paused; white-hat hackers have negotiated with Blockstream and promised to return funds after patching, but funds have not yet been returned, and most of the federation wallet's Bitcoin remains under the hackers' control.
Source evidence: Cointelegraph · Decrypt
- #04
How 4,000 BTC walked out of Blockstream’s Liquid Network
Detailed the attack method: the attacker exploited a validation flaw in the Elements software, using SideSwap's PAK authorization to withdraw ~4,000 BTC from the federation wallet, bypassing the emergency backup key path, with all inputs spending 11 of the 15 required signatures.
State after update: Liquid Network remains paused; white-hat hackers have negotiated but not yet returned funds, with most BTC still under their control; detailed attack method now disclosed.
Source evidence: Protos
- #05
Tokens created out of thin air may explain how $320 million in Bitcoin left the Liquid sidechain
Researchers suspect a validation cache flaw in the Liquid sidechain allowed unbacked L-BTC to be redeemed for real Bitcoin, providing a more specific explanation of the attack mechanism, including a cache-key collision that let invalid transactions bypass range-proof checks, and reporting a possible node split.
State after update: Liquid Network remains paused; white-hat hackers have not yet returned funds, with most BTC still under their control; the attack mechanism is now further clarified involving a validation cache flaw and node split, but no official patch or return of funds has been confirmed.
Source evidence: CryptoSlate
- #06
Liquid Attacker Broadcasts Return Of 3,400 BTC, Keeps 598
The attacker broadcast a transaction returning 3,400 BTC to the Liquid federation wallet while keeping 598.50 BTC; the transaction is unconfirmed and flagged as replaceable, and neither side has published anything about the split.
State after update: The Liquid Network remains paused; the attacker has broadcast a transaction returning 3,400 BTC while keeping 598.50 BTC, but the transaction is unconfirmed and flagged as replaceable, so funds have not yet been returned; the situation remains under monitoring.
Source evidence: The Defiant · The Block · CoinDesk
- #07
Liquid recovers 3,400 BTC as hacker asks “is that ok?” after pocketing $47 million in Bitcoin
Confirmed that the attacker's broadcast return transaction was confirmed in block 965950 at 16:09:25 UTC, actually returning 3,400 BTC to the federation wallet, while the hacker retained approximately 598.5 BTC (~$47 million), with an on-chain message asking 'is that ok.' Blockstream's status page still lists an active incident and major outage affecting public bridge nodes; full L-BTC backing and redemption access are not yet restored.
State after update: The Liquid Network remains paused; 3,400 BTC have been confirmed returned to the federation wallet, but the attacker retains approximately 598.5 BTC; redemption access is not restored, Blockstream's status page shows the incident continuing, and full backing and recovery remain unconfirmed.
Source evidence: CryptoSlate