The Blockstream representatives, led by Adam Back, informed the hacker that their bridge nodes have been patched and it was safe to return the money. The message, signed with their key, was attached to a PGP-signed on-chain note. This key was verified against the security key, published on the blockchain by Blockstream. Consequently, the hacker transferred 3,400 BTC to the federation address on block 965,950. Thus, about 598.5 BTC (or $47.3 million at the time of writing) remained in the hands of the attacker.
In the previous message, on block 965,822, the hacker proposed to return most of the bitcoin to the federation address. Earlier, Blockstream contacted the unknown party initiating the security team. The conversation began after Liquid announced on September 6 that 4,000 BTC (about $320 million at the time) was stolen from its treasury. Notably, the SideSwap Peg-out Authorization Key was used to initiate the withdrawal, but it was not hacked.
On X, SideSwap announced that the attack involved 4,000 LBTC, which the company’s peg-out service burned.
The Liquid Federation transferred 3,996 BTC to the customer’s bitcoin address as payment for the 4,000 LBTC.
According to SideSwap, the error occurred because of an “elements software issue or bug,” resulting in the creation of the 4,000 LBTC. Nevertheless, the trading platform claimed that its servers were not breached, and its peg-out authorization key was secure.
Liquid Network advised to stop all blockchain activities, including the bridge, and suspended LBTC deposits and withdrawals at exchanges.
Meanwhile, SideSwap stated that it would pause swaps, peg-ins, and peg-outs of its proof-of-reserve token until the network resumes operations.
White-hat hackers are common in the cryptocurrency industry, especially when large sums of money are at risk. In most cases, crypto heists end with the attackers disappearing with a small portion of the stolen funds. However, dealing with “white hats” can be challenging for projects in many ways.
Notably, in the past years, several projects have seen an increase in attacks, followed by negotiations about returning the majority of the hijacked crypto. Some projects even offer rewards to cryptos, threatening to take legal action if they do not provide evidence of cracking their systems.
It remains unclear when Liquid Network and Blockstream will resume operations. However, until the resumption of operations, the attacker can enjoy a tidy sum of money – about $47.3 million.
