Exchange Ranking
Top Exchanges
24h Volume Ranking
Popularity Ranking
Exchange BTC Balance
Proof of Reserves
Decentralized Exchanges
Funding Rate
Funding Heatmap
Liquidation Data
Max Pain
Long/Short Ratio
Whale L/S Ratio
Binance/Okex/Huobi L/S
Bitfinex Margin L/S
ETF Tracker
Solana ETF
XRP ETF
Hong Kong ETF
Bitcoin Treasuries
Crypto Reversal
Ethereum Reserves
HyperLiquid Wallet Analysis
Hyperliquid Whale Watch
Large Transactions
On-chain Movement
Bitcoin ROI
Stablecoin Market Cap
Options Analysis
News
Articles
Economic Calendar
Features
Wallet
Contract Calculator
Security
Collections
Watchlist
Following
BTC Liquid sidechain was attacked: Hackers minted US$318.7 million worth of L-BTC and recovered some assets
On September 6, technical analysis by blockchain security company CertiK showed that a software vulnerability in the Liquid sidechain was exploited by attackers. The attackers minted approximately 4,000 L-BTC tokens out of thin air without any bitcoins as collateral. Subsequently, they exchanged these tokens for real bitcoins through Liquid's "peg-out"(cross-chain withdrawal) mechanism, resulting in the transfer of most of the bitcoins held in the sidechain (about 95%). After the incident, Liquid sidechain suspended operations on the same day.
Liquid's Peg-out system operating mechanism
Liquid is a federal Bitcoin sidechain jointly developed and maintained by an exchange and a consortium of companies. The alliance jointly holds real bitcoin reserves in a multi-signature wallet. The native token L-BTC of the sidechain is fully backed by these reserves. The process of withdrawing funds from Liquid is called "peg-out" and requires a specific "Withdrawal Authorization Key"(PAK). Only users who have registered for PAK can unlock Bitcoin directly from the main Bitcoin network, while most users need to interact with alliance members or participating exchanges to complete the operation.
The system is designed with strict controls to prevent funds from being transferred to malicious addresses even if certain alliance members are compromised. However, the attacker still found a loophole in this process.
Alex Thorn, chief research director at Galaxy Digital, discussed the incident on Unchained's Uneasy Money podcast. Thorn pointed out that although the agreement is intended to limit direct extractions, platforms like SideSwap simplify the extraction process by forwarding customer requests and sending BTC to any address provided by the customer. Thorn said the process effectively bypasses the expected access list, questioning: "SideSwap allows anyone to show up with an address, withdraw funds from Liquid and automatically forward them to any address provided by the customer. I don't know why this is allowed."
Liquid's official documents confirm that ordinary users usually make withdrawals through alliance members or third-party exchanges such as Bitfinex and SideSwap. Customers deliver L-BTC and specify a Bitcoin address, and receive BTC after the network process is completed.
Technical reasons and asset impact
CertiK attributed the vulnerability to "vague cache key encoding in the proof-of-scope verification cache." This allows attackers to warm up the cache and bypass full verification by forging transactions. The process resulted in the casting of 3,998.5 unsupported L-BTC pieces, which CertiK estimated at the time to be worth approximately US$318.7 million.
Both Liquid and SideSwap stated that their critical infrastructure was not compromised and that from a technical perspective, the extraction system was operating as expected. SideSwap reported that these tokens were processed through a valid authorization, and the service was unable to distinguish between counterfeit L-BTC and legitimate tokens. After negotiation, the attacker, who claimed to be a white-hat hacker, returned 3,400 BTC and retained 598.5 BTC.
Noun explanation
Liquid: Bitcoin sidechain built and operated by Blockstream and a consortium of exchanges. It enables the rapid, confidential and interoperable transfer of Bitcoin (in the form of L-BTC tokens) between participating platforms.
SideSwap: An unmanaged exchange provider that, as a member of the Liquid Alliance, provides atomic exchange and extraction services to users on the Liquid network.
During the sidechain suspension, the exploit and subsequent asset recovery drew attention to the complexity of the federal blockchain cross-chain custody and security framework. The Liquid Alliance has announced that it is working to resolve the vulnerability and reviewing the operating procedures that led to the extraction.
