The Liquid Network, a federated Bitcoin sidechain, reported that white-hat hackers withdrew approximately 4,000 BTC, valued at roughly $320 million, from its federation wallet. The incident involved the exploitation of an inflation bug on the L-BTC sidechain, which allowed the unauthorized creation of L-BTC and subsequent redemption for on-chain Bitcoin.
The federation, founded by Blockstream, utilizes a multisig structure requiring 11 out of 15 members to sign transactions. The hackers executed a peg-out transaction using the SideSwap Peg-out Authorization Key. Following the breach, the treasury balance dropped from over 4,200 BTC to approximately 207 BTC.
In response, the network disabled bridge nodes and paused the sidechain. Exchanges were instructed to suspend L-BTC deposits and withdrawals. Other assets on the network, such as USDT, DePix, and RWAs, remain unaffected. The network continues to produce blocks despite the restricted access.
The stolen funds were moved to an address ending in 6gyqjlte. The hackers included a message in an OP_RETURN field claiming to be white-hats and requested contact. Blockstream reportedly attempted to reach the hackers via a mainnet transaction, while the hackers later provided a Signal contact handle.