Blockstream's Liquid sidechain has been paused after nearly all the bitcoin held in its federation wallet was withdrawn on Sunday, with the recipient identifying themselves onchain as white hats.
Liquid said the funds left through a working authorization key rather than a stolen one, leaving the route into the peg unexplained. The wallet that backs every L-BTC in circulation now holds 197.47 BTC. Two transactions moved the funds: the first, confirmed in block 965780 at 14:01 UTC, sent 2.5 BTC, and the second, twenty-seven minutes later, sent 3,995.99999857 BTC. Both landed at address bc1ql4mfu6aundtkksxklfajs2h3t9nzcd6gyqjlte, which now holds 3,998.49748445 BTC, worth about $319.5 million at bitcoin's price of $79,901, per CoinGecko. Bitcoin was up 0.10% on the day.
Four hours after the second withdrawal, the address consolidated the funds into a single output and attached a message in an OP_RETURN field: "we are whitehats. contact us on chain." The same transaction sent 1,000 satoshis back to the federation wallet it had just emptied. Blockstream answered onchain an hour later, paying 1,000 satoshis to the address with the message "Please contact security@blockstream.com."
Liquid posted its account of the incident at 4:25 p.m. ET, writing that "Purported white-hat hackers have withdrawn ~4,000 BTC (~$320 million) from the Liquid Federation wallet," and that "the funds were withdrawn via the SideSwap PAK (Peg-out Authorization Key), but that key was not compromised, nor were any others." SideSwap is a federation member that performs peg-outs on behalf of Liquid users.
Response and Technical Details
- Bridge nodes were disabled so no new transactions can be submitted.
- Exchanges were told to pause L-BTC deposits and withdrawals.
- USDT, DePix and other assets issued on Liquid are unaffected.
- The peg wallet is an 11-of-15 multisig, and peg-outs are constrained by the PAK list, which per Liquid's documentation takes three days to update.
