A Bitcoin-linked blockchain used by several crypto exchanges has been hacked for $320 million, the latest in a spate of thefts to shake confidence in digital-asset security.
Liquid Network, which develops a blockchain designed for faster transactions, had roughly 4,000 of the 4,200 Bitcoin held in its Liquid Federation wallet stolen, it said in a post on X. It said the perpetrators are "purported white-hat hackers” who move funds after finding vulnerabilities with the intention of returning them, often for a fee.
"Liquid wallets will be impacted, and we’re sorry for any inconvenience,” Liquid Network wrote, adding it has halted all new transactions. "Federation members are actively working on resolving this so we can restore normal network activity.”
The hack is the latest in a string of recent attacks that have put crypto cybersecurity in the spotlight. Just last week, an attacker drained $6 million from a Crypto.com-linked digital-asset lending platform. In August, a hack of the popular offline Bitcoin wallet Coldcard raised questions about the safest way to store the digital asset.
Liquid Network was started in 2018 by Blockstream Corp., a blockchain technology company co-founded by cryptographer-turned-Bitcoin enthusiast Adam Back. It is now managed by a federation of more than 80 exchanges, infrastructure companies and asset managers, according to Blockstream. Liquid Network and Blockstream did not immediately respond to emailed requests for comment.
In its post on X, Liquid Network said the funds were withdrawn via SideSwap, a settlement platform authorized to handle transfers from the network, but that the key was not compromised.
Liquid Network is used by exchanges for quick settlement because the main Bitcoin blockchain can often suffer from slow and expensive transactions due to network congestion. Liquid Network speeds this up by issuing Liquid Bitcoin, or L-BTC, against actual Bitcoin, which it locks up.
Blockstream lists several major exchanges as users of Liquid, including BTSE and Bitfinex, which shares the same parent company as Tether, the world’s largest stablecoin issuer. BitMEX, which has announced that it is shutting down this month, was also a user.
Aneirin Flynn, chief executive of cybersecurity technology firm FailSafe, said preliminary evidence points to a bug allowing the minting of L-BTC.
The breach "is the latest in a spate of attacks exposing weaknesses in crypto infrastructure this year,” Flynn said. "With roughly 95% of reserves drained and the network paused, the incident exposes a critical weakness in Liquid’s validation and backing model.” - Bloomberg
