Liquid Network Bitcoin Bridge Hack: Attackers Return $270M After $320M Exploit

Blockstream's Liquid Network, a Bitcoin layer-2 solution, suffered a major security breach over the weekend when attackers extracted around 4,000 Bitcoin from the federation's custody wallet, the reserve backing the L-BTC token's 1:1 peg. The theft left only 197 BTC in reserves from an initial holding of about 4,200 BTC, immediately breaking L-BTC's full collateralization. Operators reacted quickly, shutting down bridge infrastructure, halting network activity, and working with exchanges to suspend L-BTC deposits and withdrawals. Other assets on the network, such as tether, were not affected.

The attackers described themselves as ethical hackers and offered to return the funds once Blockstream confirmed the underlying vulnerability was fixed and all nodes had applied the necessary updates. Both sides negotiated openly using cryptographically signed messages embedded in Bitcoin transactions. After Blockstream verified the bridge infrastructure had been patched, the attackers sent back 3,400 BTC, about 85% of what was taken, worth roughly $270 million. Around 598 BTC, valued at about $47 million, remains with the attackers, with discussions reportedly ongoing.

The unauthorised withdrawal was carried out using SideSwap's Peg-out Authorization Key, though both Liquid and SideSwap stated the key itself was not compromised, pointing instead to a flaw in the bridge process.