The Liquid Network, a Bitcoin sidechain developed by Blockstream, announced on Tuesday that it has entered the final stages of recovery following a security breach in September. The incident involved hackers exploiting an inflation bug to create over 4,000 LBTC tokens, which were then exchanged for approximately 4,000 bitcoins from the network’s federation wallet. At the time of the theft, the stolen assets were valued at roughly $320 million.
Blockstream negotiated with the attackers, who identified themselves as white hat hackers, resulting in the return of most of the funds. However, the hackers retained approximately 600 bitcoins, representing 15% of the total stolen amount and worth close to $50 million at current prices. During the exchange, which was conducted via messages embedded in Bitcoin blocks, the attackers criticized Blockstream as "delusional, greedy, and arrogant," demanding a 10% bounty paid from company funds to avoid further losses for holders. It remains unclear if a private settlement was reached regarding the remaining coins.
The network has restored full service for LBTC-to-Bitcoin swaps and interactions with the Lightning Network. According to a blog post, the final phase of restoration involves reestablishing the network’s 1:1 bitcoin backing and controlled reactivation of Federation peg-outs for authorized key holders. Blockstream CEO Adam Back confirmed on social media that swap services are operational again, supported by enhanced security measures implemented by the Federation and independent experts.
The restoration of the Liquid Network highlights the complex dynamics between protocol developers and security researchers operating in gray areas. While the immediate threat to liquidity was mitigated through negotiation, the retention of 600 bitcoins by the attackers underscores the financial risks inherent in bug exploitation, even when framed as ethical hacking. The public nature of the dispute, conducted via on-chain messages, reveals tensions regarding compensation models for critical vulnerabilities, challenging traditional notions of responsible disclosure.
From an operational risk perspective, the incident demonstrates the resilience of federated sidechains but also their exposure to consensus-level bugs. The ability to restore 1:1 backing is crucial for maintaining user trust in asset-backed networks. However, the unresolved status of the remaining funds and the contentious relationship with the attackers may leave lingering reputational questions for Blockstream, particularly concerning how future security incidents will be managed and compensated without setting precedents that encourage extortion-like behavior.
