Bitcoin Sidechain Loses $320M in Exploit; Hackers Promise Return After Fix
Liquid Network, a Bitcoin sidechain, lost approximately $320 million in BTC after an exploit drained nearly all of its federation wallet. The attackers claim to be white-hat hackers and say they will return the funds once the vulnerability is fixed. Liquid has suspended transactions and is working with the attackers to resolve the issue.
Liquid's security model relies on a federation of over 80 financial entities, with 15 rotating functionaries requiring 11 signatures to authorize block signing and wallet movements. The exploit bypassed this multisig setup, as the funds exited through a specific authorization key tied to SideSwap, a decentralized exchange operating on the sidechain. Both Liquid and SideSwap maintain that no private keys were compromised.
SideSwap clarified that a customer submitted a standard peg-out request for 4,000 L-BTC, which was processed normally, resulting in the federation releasing nearly 4,000 BTC to the recipient's address. The exchange noted its systems could not differentiate these tokens from legitimate ones. This incident follows other recent crypto infrastructure breaches, such as the Drift trading platform halting deposits and withdrawals.
This incident could erode user confidence in federated sidechains, which rely on trusted intermediaries rather than decentralized miners. If the attackers fail to return the funds, affected users may face significant financial losses, while the broader cryptocurrency market could see increased scrutiny over custodial security practices. The promise of a refund, if fulfilled, might mitigate immediate damage, but the precedent of a near-total wallet drain could prompt regulators and investors to reassess the resilience of similar bridging technologies.