Blockstream Secures Liquid Network Following $320 Million Exploit

Blockstream announced on September 7 that its Liquid Network bridge nodes have been secured following an exploit that resulted in the loss of approximately 4,000 BTC, valued at roughly $320 million. The incident, which occurred on September 6, involved a software bug in the Elements code that enabled an attacker to trigger a valid peg-out using invalid L-BTC.

The vulnerability allowed the attacker to abuse the SideSwap Peg-out Authorization Key, a mechanism used to convert L-BTC into native Bitcoin. Prior to the exploit, the Liquid Federation wallet held over 4,200 BTC, but reserves fell to approximately 197 BTC afterward, leaving L-BTC significantly under-collateralized.

Blockstream stated that the incident was caused by a software bug rather than a compromise of cryptographic keys or federation keys. In response, the company disabled bridge nodes, paused network activity, and requested that exchanges suspend L-BTC deposits and withdrawals.

Communication between Blockstream and the exploiter has taken place via PGP-signed OP_RETURN transactions on the Bitcoin blockchain. Through this channel, the attacker indicated an intention to return the stolen funds once the system was patched. As of September 7, approximately 3,998.5 BTC remained in the exploiter's wallet.

Other assets on the Liquid Network, including USDT and DePix, were not affected by the exploit, as the vulnerability was limited to the L-BTC peg-out mechanism. Blockstream aims to restore the collateral ratio of L-BTC and resume normal operations once the funds are returned.