Liquid Network Recovers From $320M Bitcoin Heist After Attackers Return Majority of Funds

Over the weekend, attackers made off with roughly $320 million in bitcoin from the Liquid Network, a blockchain platform operated by venture-backed firm Blockstream Inc. In an unusual turn of events, the perpetrators gave back the majority of their haul shortly thereafter, keeping only 598 of the 4,000 stolen coins—valued at approximately $47 million. The attackers characterized their retained portion as a bounty for exposing a security flaw within the Liquid Network infrastructure.

Blockstream launched the Liquid Network in 2018 as a layer two Bitcoin network, functioning as a sidechain built atop Bitcoin's underlying infrastructure. Unlike Bitcoin's decentralized transaction verification system, which relies on thousands of independently operated full nodes to authenticate transfers, the Liquid Network employs a more centralized approach. Approximately 80 organizations—including cryptocurrency exchanges, wallet providers, and other industry participants—handle transaction verification duties, with roughly 15 actively engaged in the process at any moment.

The Liquid Network distinguishes itself from Bitcoin in several ways beyond its verification mechanism. Transaction values remain hidden from other users on the network. Additionally, a system called SideSwap enables the movement of funds across different blockchains, and this very system became the focal point of the weekend attack.

SideSwap operates through a straightforward deposit-and-withdrawal mechanism. When users join the Liquid Network, they transfer bitcoins into SideSwap, which secures the assets in a digital vault and issues equivalent platform-specific stablecoins. To exit the network, users initiate a reversal process that returns their original bitcoins.

The theft centered on a piece of data infrastructure known as the peg-out authorization key, or PKA. Blockstream's leadership indicated that attackers leveraged this key to execute the heist, though they maintained that the PKA itself had not been compromised. SideSwap's development team disclosed via X that the perpetrators exploited a vulnerability within Elements, an open-source framework that serves as the foundation for the Liquid Network, powering both its centralized transaction approval system and other critical functions.

The 4,000 coins taken represented approximately 95% of the Liquid Network's Bitcoin holdings. Other digital assets stored on the sidechain remained untouched. Following the breach, the attackers transmitted a message to Blockstream through the public Bitcoin transaction ledger, signaling their intention to return the bulk of the cryptocurrency once the company deployed a fix for the vulnerability.

This incident marks the latest in a series of recent security breaches targeting cryptocurrency platforms. In August alone, hackers conducted approximately 50 separate attacks that netted an estimated $136.3 million across the sector.