The recent breach on the Liquid network, a sidechain infrastructure dedicated to Bitcoin, has exposed a critical vulnerability within the Elements software. The flaw, located in the range-proof caching mechanism, allowed a malicious actor to fraudulently generate approximately 4,000 LBTC tokens without any underlying backing. By exploiting a federation member's access, the hacker was able to convert these assets into native bitcoins via standard withdrawal procedures. Although the network has resumed normal operations, withdrawals to the main blockchain remain suspended as a precautionary measure.
The dispute took a contentious turn when the perpetrator demanded a 10% bounty in exchange for returning the remaining 598.5 bitcoins, with an estimated value of nearly $46 million. After initially returning 3,400 units, the hacker justified the demand with a sharp critique of Blockstream's security policy, arguing that the investments allocated to network protection were negligible compared to the assets at stake. They accompanied their request with an explicit threat, warning the company that a refusal would result in a 15% outright loss for fund holders.
Blockstream’s response was firm and unequivocal: the company officially refused to pay any ransom. For the leadership, this maneuver is in no way an ethical move or a form of responsible disclosure, but constitutes theft, pure and simple. By yielding to these demands, the firm feared setting a dangerous precedent that would encourage future extortion attempts against open-source projects. Management reiterated that the integrity of the community cannot be bought and that the use of threats invalidates any status as a security researcher.
Faced with this impasse, Blockstream is now prioritizing legal and technical avenues. The company is actively collaborating with law enforcement, cryptocurrency exchanges, and forensic analysis experts to track the funds and identify the individual responsible. Thanks to the immutability of the blockchain, digital trails remain actionable for a long-term investigation. For network users, the situation remains in limbo: as long as the reserve is not fully replenished, the ability to convert LBTC assets into bitcoin remains blocked, making the reopening of these withdrawals the only true indicator of the conflict's resolution.