Liquid Network attacker says they will return most of 4,000 BTC after bug fix

Attacker promises to return most of 4,000 BTC

An individual who withdrew roughly 4,000 bitcoin (BTC) from the Liquid Network federation wallet over the weekend says they will send most of the coins back after a software bug is fixed.

The attacker communicated with Blockstream, the company behind Liquid, using on‑chain OP_RETURN messages and encrypted text. They asked Blockstream to patch the bug before returning the funds.

Key facts

• ~4,000 BTC (about $320 million) were taken from the federation wallet.
• The attacker used Bitcoin’s OP_RETURN and PGP‑encrypted messages to contact Blockstream.
• Blockstream confirmed that bridge nodes are patched and safe to return the funds.
• Liquid paused network activity and suspended LBTC deposits and withdrawals on exchanges.
• SideSwap, the peg‑out service involved, said its key was not compromised.

Blockstream’s statement

Blockstream, led by Adam Back, posted a PGP‑signed on‑chain message saying, “Bridge nodes are patched, safe to return the funds.” The signature matches the security key published on Blockstream’s website.

SideSwap’s comments

SideSwap said the affected transaction involved 4,000 L‑BTC sent to its peg‑out service, which burned the tokens using a valid authorization. The Liquid Federation then paid 3,996 BTC to a Bitcoin address. SideSwap emphasized that its systems and peg‑out key were not compromised.

What is confirmed

• The attacker withdrew roughly 4,000 BTC from the Liquid federation wallet.
• The withdrawal happened through the SideSwap peg‑out authorization key, which remains secure.
• Blockstream has patched the bridge nodes and confirmed they are safe.
• Liquid has paused network activity and suspended LBTC deposits and withdrawals.

What remains uncertain

• The exact amount the attacker will return has not been verified.
• Timing for the full return of the funds is not specified.
• Potential impact on Liquid users after the network resumes is not detailed.

Why this matters

The incident shows how a bug in the Elements software, which underlies Liquid, can affect a large amount of bitcoin. Prompt patching and communication helped prevent further loss and allowed the network to pause safely.

Next steps

Liquid plans to resume normal operations once the bug fix is confirmed and bridge nodes remain patched. Users are advised to wait for official updates before making LBTC deposits or withdrawals.

Sources

• The Block