Liquid Network loses $320 million in Bitcoin to self-described white hats

The Liquid Network exploit has resulted in roughly $320 million worth of bitcoin being withdrawn from the federation wallet of Liquid Network, a Bitcoin-based payments and settlement network, the company said on Sunday, Sept. 6. Approximately 4,000 of the 4,200 bitcoin held in the wallet were removed, prompting the network to halt new transactions while it responds to the incident.

Liquid Network exploit drains most federation wallet holdings

The Liquid Network exploit targeted a federation wallet holding approximately 4,200 bitcoin, according to a statement published by Liquid Network on X. The network said around 4,000 bitcoin were withdrawn, representing the overwhelming majority of the assets held in the wallet.

At the value cited in the report, the stolen cryptocurrency was worth about $320 million, making the incident a significant security event for the Bitcoin-based settlement network.

Liquid Network described those behind the withdrawals as “purported white-hat hackers,” a term commonly used for individuals who claim to identify or exploit vulnerabilities with the stated intention of highlighting security weaknesses. However, the statement provided in the original report did not establish the identity or ultimate intentions of the actors involved.

The Liquid Network exploit also prompted the network to suspend new transactions as it assessed the situation and worked to protect affected wallets.

“Purported white-hat hackers” withdrew around 4,000 of the 4,200 bitcoin held in its Liquid Federation wallet — Liquid Network, in a post on X.

Liquid Network exploit forces transaction halt

Following the incident, Liquid Network warned that users with wallets connected to the network could be affected.

“Liquid wallets will be impacted, and we’re sorry for any inconvenience,” — Liquid Network, in a post on X.

The decision to halt new transactions underscores the immediate operational impact of the Liquid Network exploit. By stopping additional transactions, the network sought to limit activity while the circumstances surrounding the withdrawal were examined.

The incident affects Liquid Network’s broader role as a Bitcoin-based payments and settlement infrastructure. Its federation model relies on designated entities and systems to manage transactions and withdrawals, making the security of the federation wallet an important component of the network’s operations.

Liquid Network did not provide further details in the supplied statement about how the vulnerability was discovered, how long the attackers had access to the relevant systems or whether any of the withdrawn bitcoin had been recovered.

SideSwap used to withdraw the Bitcoin

The Liquid Network exploit involved withdrawals made through SideSwap, a settlement platform that is permitted to handle withdrawals from the network, according to Liquid Network.

The network said the key used during the withdrawal process was not compromised, adding an important distinction to the circumstances surrounding the incident.

“The funds were withdrawn via SideSwap, a settlement platform permitted to handle withdrawals from the network, though the key used in the process was not compromised,” — Liquid Network, in a statement cited by Reuters.

The explanation leaves open questions about how the attackers were able to authorize or execute the withdrawals despite the relevant key not being compromised. Liquid Network had not, in the supplied report, disclosed the precise mechanism behind the unauthorized movement of funds.

The Liquid Network exploit therefore remains subject to further investigation, with the network’s transaction suspension providing time to examine the withdrawal pathway and determine the full scope of the incident.

What the Liquid Network exploit means for users

For users and participants in the Liquid ecosystem, the immediate concern is the potential effect on wallets and transactions. Liquid Network has already acknowledged that its wallets would be affected and suspended new transactions following the withdrawal of most of the bitcoin held in its federation wallet.

The Liquid Network exploit involved approximately 4,000 bitcoin out of a total 4,200 bitcoin in the affected wallet. Based on the valuation reported by Reuters, the withdrawal amounted to approximately $320 million.

The incident also highlights the importance of transaction controls and security mechanisms surrounding blockchain settlement infrastructure. Although the network said the key used in the withdrawal was not compromised, the successful movement of such a large amount of bitcoin through an authorized withdrawal platform raises questions about the safeguards surrounding federation wallet operations.

As the Liquid Network exploit investigation continues, users will be watching for further information about the cause of the withdrawals, the status of the affected bitcoin and when normal transaction activity can resume.

Liquid Network has not, in the material provided, announced a recovery of the funds or identified those responsible for the attack.