{"id":18654,"date":"2026-09-07T14:01:10","date_gmt":"2026-09-07T21:01:10","guid":{"rendered":"https:\/\/jasonsblog.ddns.net\/?p=18654"},"modified":"2026-09-07T17:46:05","modified_gmt":"2026-09-08T00:46:05","slug":"hackers-drain-320m-in-bitcoin-from-liquid-network-claim-theyre-the-good-guys","status":"publish","type":"post","link":"https:\/\/jasonsblog.ddns.net\/index.php\/2026\/09\/07\/hackers-drain-320m-in-bitcoin-from-liquid-network-claim-theyre-the-good-guys\/","title":{"rendered":"Hackers Drain $320m in Bitcoin From Liquid Network, Claim They&#8217;re the Good Guys"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">(Headline article below) This is damaging for Blockstream and Aqua Wallet, run by a couple of traitors to Bitcoin. They obviously didn&#8217;t have the security worked out with their multisig setup that was supposed to be secure. I had liked the Liquid Bitcoin network for an alternative to running Lightning and dealing with channels, but the people running the space just aren&#8217;t trustworthy nor are their security developers up to the task. I&#8217;ll stick with my own Lightning node and managing channels, or use Phoenix wallet if I want things a bit simpler. And right on queue Matthew Kratter takes it to the traitors.<\/p>\n\n\n\n<figure class=\"wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio\"><div class=\"wp-block-embed__wrapper\">\n<iframe loading=\"lazy\" title=\"Andy Back&amp;apos;s Liquid Liquidated?\" width=\"1290\" height=\"726\" src=\"https:\/\/www.youtube.com\/embed\/yJk0R5YNnms?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen><\/iframe>\n<\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">A hilarious recap of the flaw and how it was found, with the hilarious negotiation for a bounty.<\/p>\n\n\n\n<figure class=\"wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio\"><div class=\"wp-block-embed__wrapper\">\n<iframe loading=\"lazy\" title=\"The $320 Million Dollar Liquid Bitcoin Hack | Explained.\" width=\"1290\" height=\"726\" src=\"https:\/\/www.youtube.com\/embed\/_hDa8aAtBdk?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen><\/iframe>\n<\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/www.theregister.com\/security\/2026\/09\/07\/hackers-drain-320m-in-bitcoin-from-liquid-network-claim-theyre-the-good-guys\/5294770\" target=\"_blank\" rel=\"noopener\">https:\/\/www.theregister.com\/security\/2026\/09\/07\/hackers-drain-320m-in-bitcoin-from-liquid-network-claim-theyre-the-good-guys\/5294770<\/a><\/p>\n\n\n<div class=\"wp-block-ub-divider ub_divider ub-divider-orientation-horizontal\" id=\"ub_divider_da7e6d77-9c29-470a-96a0-c29991a9835b\"><div class=\"ub_divider_wrapper\" style=\"position: relative; margin-bottom: 2px; width: 100%; height: 2px; \" data-divider-alignment=\"center\"><div class=\"ub_divider_line\" style=\"border-top: 2px solid #ccc; margin-top: 2px; \"><\/div><\/div><\/div>\n\n\n<h5 class=\"wp-block-heading\">Self-described white hats promise to return &#8216;most&#8217; of the 4,000 BTC once the vulnerability is fixed <\/h5>\n\n\n\n<p class=\"wp-block-paragraph\">By Carly Page<\/p>\n\n\n\n<figure class=\"wp-block-image alignright size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"474\" height=\"266\" src=\"https:\/\/jasonsblog.ddns.net\/wp-content\/uploads\/2026\/09\/image-4.png\" alt=\"\" class=\"wp-image-18655\" srcset=\"https:\/\/jasonsblog.ddns.net\/wp-content\/uploads\/2026\/09\/image-4.png 474w, https:\/\/jasonsblog.ddns.net\/wp-content\/uploads\/2026\/09\/image-4-300x168.png 300w\" sizes=\"auto, (max-width: 474px) 100vw, 474px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Hackers have drained roughly $320 million in Bitcoin from the federation wallet backing the Liquid Network, while claiming to be the good guys.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Liquid, a Bitcoin sidechain developed by Blockstream and used by exchanges and other financial institutions, <a href=\"https:\/\/x.com\/Liquid_BTC\/status\/2096696272447218108\">said in a post on X<\/a> on Sunday that around 4,000 BTC had been withdrawn from its federation wallet by what it cautiously described as &#8220;purported white-hat hackers.&#8221;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The wallet held about 4,200 BTC before the incident, meaning whoever was behind the exploit removed roughly 95 percent of its holdings.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Liquid disabled its bridge nodes while federation members investigate and asked exchanges to suspend L-BTC deposits and withdrawals.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The people behind the withdrawal, meanwhile, appear keen to establish that this isn&#8217;t your standard crypto heist.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In a message embedded in a Bitcoin transaction, they identified themselves as &#8220;whitehats&#8221; and asked Blockstream to get in touch. Blockstream responded on-chain with contact details for its security team, and Liquid said the parties subsequently moved their communications to encrypted channels.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Those responsible said they would return &#8220;most&#8221; of the Bitcoin once the vulnerability was fixed and Liquid&#8217;s nodes had been updated.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">&#8220;Please fix the bug first,&#8221; the on-chain message said. &#8220;The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix.&#8221;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Exactly how they managed to move almost the entire federation wallet remains under investigation.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Liquid said the BTC was withdrawn through SideSwap using its Peg-out Authorization Key, or PAK, but that neither SideSwap&#8217;s key nor any other PAK appeared to have been compromised. PAKs allow federation functionaries to recognize destinations authorized to receive peg-outs; the functionaries collectively release the corresponding Bitcoin.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">That leaves the rather important question of how an apparently authorized SideSwap peg-out came to empty almost the entire federation wallet without the relevant PAK being compromised.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Other assets issued on Liquid, including stablecoins, do not appear to have been directly affected, and the Bitcoin network itself was untouched.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The incident is another reminder that adding Bitcoin to something does not give it Bitcoin&#8217;s security model. Liquid is a federated sidechain whose members collectively manage the Bitcoin backing L-BTC, rather than relying on Bitcoin&#8217;s miners to secure those funds.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For now, those funds appear to be in the hands of people who insist they&#8217;re conducting security research. Whether all 4,000 BTC eventually find their way home may determine how generous everyone feels about that description.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>(Headline article below) This is damaging for Blockstream and Aqua Wallet, run by a couple of traitors to Bitcoin. They obviously didn&#8217;t have the security worked out with their multisig setup that was supposed to be secure. I had liked the Liquid Bitcoin network for an alternative to running Lightning and dealing with channels, but [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6,7],"tags":[],"class_list":["post-18654","post","type-post","status-publish","format-standard","hentry","category-tech","category-world"],"blocksy_meta":{"styles_descriptor":{"styles":{"desktop":"","tablet":"","mobile":""},"google_fonts":[],"version":8}},"featured_image_src":null,"author_info":{"display_name":"Jason","author_link":"https:\/\/jasonsblog.ddns.net\/index.php\/author\/jturning\/"},"_links":{"self":[{"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/posts\/18654","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/comments?post=18654"}],"version-history":[{"count":3,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/posts\/18654\/revisions"}],"predecessor-version":[{"id":18659,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/posts\/18654\/revisions\/18659"}],"wp:attachment":[{"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/media?parent=18654"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/categories?post=18654"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/tags?post=18654"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}