The Bitcoin sidechain, Liquid Network, has been rocked by a major security incident resulting in the movement of nearly 4,000 BTC, a sum valued at approximately $320 million. These funds, held in the Liquid Federation’s wallet, were transferred by individuals claiming to be "white-hat" hackers. Through a message embedded in an on-chain transaction, they assert they have identified a vulnerability and are demanding direct negotiations with the development team to arrange a potential return, conditional upon a technical resolution of the flaw.
In an immediate response, the Blockstream team has ordered a total suspension of operations involving LBTC tokens across all partner exchanges. As a precautionary measure, the Liquid blockchain has been paused, leading to a temporary deactivation of bridge nodes. While third-party assets, such as USDT or real-world assets (RWA) on the network, appear to have been spared for now, the situation remains critical for Liquid wallet users, whose access to assets remains uncertain while technical teams work to stabilize the protocol.
This breach has raised serious questions within the crypto ecosystem, with some experts comparing the methods used to infamous attacks of the past. The strategy of draining a bridge before soliciting a public dialogue is reminiscent of the Ronin network hack, which resulted in a massive $625 million theft. The cybersecurity community points to a major inconsistency: the standard approach for an ethical hacker is to notify developers privately before taking any action, rather than exfiltrating funds of this magnitude under the guise of "good faith."
At present, the 3,998.50 BTC stolen remain locked at an address controlled by the attackers, creating a palpable atmosphere of tension. Liquid developers are working actively to establish a secure communication channel with these protagonists while deploying the necessary patches. The stakes are high: it is not just about recovering a colossal sum, but above all about restoring user confidence in the protocol’s robustness, as the true nature of the hackers' intentions remains, at this stage, impossible to confirm with certainty.