The attacker who pulled roughly 4,000 BTC out of Liquid Network’s federation wallet over the weekend says the coins are coming back, on one condition: that the bug behind the withdrawal is patched everywhere first.
Messages sent onchain
The party, which Liquid described as a purported white-hat hacker, has been communicating with Blockstream through Bitcoin OP_RETURN messages and PGP-encrypted text.
In a message at block 965,875, they told the company to “fix the bug first” and confirm that every node had been patched before anything moved.
Blockstream, led by Adam Back, answered with a PGP-signed onchain message:
“Bridge nodes are patched, safe to return the funds.”
The signature verifies against the security key published on Blockstream’s website.
The roughly 4,000 BTC still sat in the attacker’s wallet at the time of publication.
How the coins left
Liquid disclosed on Sept. 6 that about 4,000 of the 4,200 BTC in its Liquid Federation wallet, then worth close to $320 million, had been withdrawn.
The funds moved through SideSwap’s Peg-out Authorization Key, though the network said that key itself was never compromised.
SideSwap said on X that the transaction involved 4,000 L-BTC sent to its peg-out service, which burned the tokens under a valid authorization before the Liquid Federation paid out 3,996 BTC to the customer’s bitcoin address.
Blockstream later traced the L-BTC back to a bug in the Elements software, according to SideSwap, which added that neither its systems nor its authorization key were breached.
Network still frozen
Blockstream had first reached out to the party at block 965,822, asking it to contact the company’s security team.
Liquid has since paused network activity, with bridge nodes disabled and LBTC deposits and withdrawals suspended at exchanges.
SideSwap said swaps, peg-ins, and peg-outs remain on hold until the network resumes.
Click Here For The Original Source.
