Approximately two months ago, a vulnerability within the Liquid Network’s software allowed an intruder to generate nearly 4,000 LBTC tokens without any backing, subsequently exchanging them for actual bitcoin valued at around $320 million. Liquid operates as a Bitcoin sidechain overseen by a coalition of firms led by Blockstream and aims to facilitate quicker and more secure bitcoin transactions compared to the primary blockchain. This breach significantly depleted the federation’s wallet, reducing holdings from about 4,205 bitcoin to merely 197, leaving traders and exchanges with tokens that were minimally backed. As of Monday, the Liquid Federation confirmed that the discrepancy has been resolved, restoring full backing for all LBTC tokens, much to the relief of token holders. The method by which this gap was bridged warrants further examination since the hacker did not return all the stolen funds.
The ethical hacker who retained $47 million
The hacker, identifying as a ‘white hat,’ left a note in a Bitcoin transaction to this effect and returned approximately 3,400 bitcoin the day following the breach, after Blockstream announced fixes to the bridge nodes. However, around 600 bitcoin, worth about $47 million today, remained with them, and the hacker requested a 10 percent bug bounty for its return. Blockstream declined this offer, stating clearly that taking assets without permission and refusing to return them constitutes a crime and not responsible disclosure; labeling this act as theft rather than ethical hacking behavior. The company opted against paying a ransom for the remaining funds, leaving the assets unrecovered. This decision prompted the federation to seek around 600 bitcoin from other sources to stabilize LBTC backing.
Blockstream stepped up
According to Samson Mow, a board member of the Liquid Federation, the funds were provided by Blockstream itself to rectify the situation. The contributions were made in segments, beginning with about 50 bitcoin on October 28, followed by 300 bitcoin, and another 250 bitcoin on November 2, with the federation officially announcing full backing on the same day. Adam Back, the CEO of Blockstream, shared a screenshot of the network dashboard confirming that assets were once again in alignment with liabilities at full capacity, showing a reserve deficit of zero. SideSwap, one of the federation’s partners, reported a reserve of approximately 4,270 bitcoin that matched their LBTC on November 3. The vulnerability was swiftly addressed, with a patched Elements software released just days after the incident, on September 9, and Blockstream confirmed that no private keys were compromised nor was any of the network’s personnel hacked.
What remains unsettled
While the restoration of backing is a positive development, it does not signify a complete return to normal operations, as direct withdrawals from the federation remain restricted. Users have been required to exchange bitcoin and LBTC through selected providers for several weeks, foregoing the network’s direct peg-out method. The federation has yet to state when these restrictions will be lifted, and this week’s announcement did not clarify this. Additionally, there’s uncertainty regarding who precisely financed the necessary replenishments, as while the blockchain shows transaction records, it does not identify the individuals associated with those deposits; only Mow has openly indicated Blockstream’s involvement. For LBTC holders, the key takeaway remains that the token is once more fully backed, helping the sidechain recover from an incident that drained nearly 95 percent of its reserves within a day. For others, this situation serves as a stark reminder that the terms ‘white hat’ and ‘hacker’ can sometimes refer to the same individual at different times, with the line between a recovery effort and a heist being defined by how much of the money is ultimately returned.
Liquid is once again stable, which is crucial, as a sidechain that loses its backing permanently is effectively rendered inoperative. Blockstream invested approximately $47 million to achieve this, stood firm against labeling a thief as a white hat, and managed to restore full backing within roughly two months. The crucial lesson for anyone involved with tokens on a sidechain or bridge is straightforward: the integrity of the peg is only as strong as the entities backing it, and in this instance, those backing it followed through. Meanwhile, the attacker continues to hold around 600 bitcoin, and their identity remains unknown.
——-
Author: Cedric Holloway
New York Newsroom
GlobalCryptoPress | Breaking Crypto News