Whitehat Holds $320 Million in Bitcoin After Liquid Network Bug Allows Large Peg‑Out
What happened
On September 6 a bug in the Liquid Network allowed a customer to submit 4,000 L‑BTC (Liquid’s Bitcoin‑backed token) to SideSwap’s peg‑out service. The request passed normal checks and the Liquid federation released roughly 3,996 real BTC. The Bitcoin was moved to an address that now holds about 3,998.5 BTC. The funds are being held by a self‑identified “whitehat” hacker who says they will return most of the money after the bug is fixed.
Key facts
- 4,000 L‑BTC were presented for redemption.
- Liquid’s federation released about 3,996 BTC.
- The bridge nodes were disabled and SideSwap paused all swaps.
- Whitehat hackers communicated via on‑chain OP_RETURN messages.
- Blockstream traced the issue to a flaw in Elements, the software underlying Liquid.
Official statements
Liquid’s official account confirmed that the peg‑out used a valid Peg‑out Authorization Key and that no federation signing keys were compromised. SideSwap said the request passed its authorization process. Bitslab, a blockchain security firm, reported that at least 11 of Liquid’s 15 functionaries signed the transaction.
Additional observations
Galaxy Digital researcher Alex Thorn noted that Blockstream first asked the holder to contact its security team. The holder replied that most of the Bitcoin would be sent back after the bug is patched, and later added the condition that the fix be applied across all nodes before any funds are returned.
Confirmed details
- The peg‑out transaction was authorized and executed on September 6.
- Approximately 3,996 BTC left Liquid’s federation reserve.
- Liquid’s bridge nodes and SideSwap’s peg‑in/peg‑out services were paused.
- At least 11 federation signers approved the transaction.
- The underlying cause is linked to a software bug in Elements.
Open questions
- The exact technical description of the Elements bug has not been published.
- It is unclear how many nodes have been patched and when the network will be fully restored.
- The timeline for returning the Bitcoin depends on the fix being verified.
Why it matters
Liquid is supposed to keep a one‑to‑one reserve of real Bitcoin for every L‑BTC in circulation. If invalid L‑BTC can be created and redeemed, the reserve can be depleted without a key compromise, exposing a fundamental risk in the bridge that moves assets between Liquid and the Bitcoin main chain.
Next steps
- Blockstream must patch the Elements flaw on all affected nodes.
- Liquid must verify that the reserve once again matches the outstanding L‑BTC.
- After the fix is confirmed, the whitehat intends to return most of the Bitcoin.
