Blockstream in talks with hackers to recover $47 million in stolen Bitcoin from Liquid Network

Liquid Network said Tuesday that Blockstream, the Bitcoin infrastructure company behind the sidechain, is in ongoing talks with the hackers who exploited the network for roughly $320 million to fully recover the stolen funds.

“Discussions between Blockstream and the individuals responsible are ongoing to secure the return of the remaining funds,” Liquid said in an incident report on X.

The talks stem from Sunday’s withdrawal of approximately 4,000 BTC, after a flaw in Liquid’s underlying Elements software allowed the creation of unbacked L-BTC tokens that were exchanged for reserve Bitcoin. The hackers returned 3,400 BTC Monday, leaving about 600 BTC, valued at roughly $47 million, outstanding.

Liquid did not say what the terms of the talks were or provide a timeline for recovering the remaining BTC.

According to Liquid, after stealing the tokens, the still-unknown individuals exchanged the BTC through SideSwap, a Liquid Federation member operating a withdrawal service. The software’s transaction checks accepted the unbacked tokens as valid before the withdrawal began.

“Because the validation failure occurred at the transaction level before the peg-out was initiated, both SideSwap’s node and the Liquid Network’s globally distributed functionary nodes accepted the LBTC as valid,” the devs wrote.

Liquid’s reserve fell from approximately 4,205 BTC to 197 BTC after that withdrawal and others processed before operations halted. USDT and other Liquid-issued tokens were unaffected by the vulnerability, according to Liquid, but users could not transact while the network was paused.

“The Liquid Federation functionaries were not hacked, and no private keys were compromised,” Liquid said, attempting to reassure users. “The peg-out mechanism that authorizes withdrawals to whitelisted addresses operated as designed.”

At the time of the exploit, the individuals identified themselves as white-hat security researchers in a message on Bitcoin’s blockchain. Still, some, including Ledger Chief Technology Officer Charles Guillemet, remained skeptical of the actors’ white-hat claim after most of the funds were returned.

“The ‘white hats’ still hold 600 BTC,” Guillemet wrote on X. “If this was ever a negotiated reward under an encrypted contract signed on-chain, it looks more like extortion than white-hat hacking!”

According to Liquid Network devs, Blockstream is preparing an emergency update while the fix undergoes review, following a patch to its bridge nodes on Monday. Once the update is finalized, network operators will make further adjustments to restore operations and correct the network’s state, including rejecting the invalid withdrawal.

“Our immediate priorities are recovering the remaining funds and resuming normal network operations safely and as quickly as possible,” Liquid said.