The exploit was made possible by a software flaw in Liquid's underlying Elements software. This vulnerability allowed the creation of unbacked L-BTC tokens, which the attackers then exchanged for reserve Bitcoin through SideSwap, a member of the Liquid Federation.
As a result of the withdrawal and other processed transactions, the Liquid reserve dropped from approximately 4,205 BTC to 197 BTC before operations were halted. Liquid confirmed that USDT and other issued tokens remained unaffected, and no private keys were compromised.
The individuals involved identified themselves as white-hat researchers via a blockchain message. However, Ledger CTO Charles Guillemet expressed skepticism, suggesting the situation resembles extortion rather than a security reward.
Blockstream is currently preparing an emergency update to the network. Following a patch to bridge nodes on Monday, operators will implement further adjustments to restore operations and reject the invalid withdrawal.