Exchange Ranking
Top Exchanges
24h Volume Ranking
Popularity Ranking
Exchange BTC Balance
Proof of Reserves
Decentralized Exchanges
Funding Rate
Funding Heatmap
Liquidation Data
Max Pain
Long/Short Ratio
Whale L/S Ratio
Binance/Okex/Huobi L/S
Bitfinex Margin L/S
ETF Tracker
Solana ETF
XRP ETF
Hong Kong ETF
Bitcoin Treasuries
Crypto Reversal
Ethereum Reserves
HyperLiquid Wallet Analysis
Hyperliquid Whale Watch
Large Transactions
On-chain Movement
Bitcoin ROI
Stablecoin Market Cap
Options Analysis
News
Articles
Economic Calendar
Features
Wallet
Contract Calculator
Security
Collections
Watchlist
Following
BTC Key Facts
Blockstream said it would not pay ransom for bitcoins stolen from the Liquid network and rejected a request that it fill the funding gap itself. After the attackers returned 3,400 BTC on September 7, approximately 598.5 BTC (worth approximately US$47 million) remained unrecovered.
Liquid Network resumed block production and trading on September 10, but as a precautionary measure, the peg-outs feature remains disabled.
Refusal to Pay Ransom
Blockstream announced on Friday that it would not pay ransom for Bitcoin (BTC) stolen from the Liquid network, rejecting attackers 'requests to cover the remaining 15 percent of the funds. This refusal left 598.5 BTC worth approximately US$47 million remaining unrecovered five days after the front chain was cleared.
Blockstream stated in a statement: "Unauthorized acquisition of assets and withholding their return is a criminal act and not a responsible security disclosure." "This is not white hat behavior, this is theft." The company said it would not accept a precedent where open source developers face "extortion far beyond their financial participation."
Threat from attackers
The attacker once told Blockstream via an online message that it should use its own funds to pay the missing 15% as a vulnerability bounty. "You must pay 15% of your own money as a loophole bounty, or you will cause a 15% loss to all holders." They wrote in the message.
Principle of Liquid Network Vulnerability
Liquid is a Bitcoin sidechain operated by a consortium of exchanges and companies, in which BTC is locked and reissued as LBTC for faster settlement. Liquid pointed out in the incident report that on September 6, there was a flaw in the way Liquid node cache proof of range verification in the open source Elements software, resulting in approximately 4,000 LBTC being created without corresponding bitcoin endorsements.
These unendorsed tokens were converted to bitcoin through SideSwap, a member of the alliance holding an anchored withdrawal authorization key, and the alliance then released the funds as authorized. Liquid said no keys were compromised, but reserves had been reduced from approximately 4,205 BTC to 197 BTC before the network was suspended.
SideSwap said in a statement that its authorization keys are kept online and payouts (payment processes) are automatically forwarded, and that the pipeline does not apply any size or speed limits.
Transactions resumed, anchored withdrawals are still disabled
Blockstream patched Liquid's bridge node on September 7, and the attacker returned 3,400 BTC to the Alliance Wallet the same day. Emergency Elements version v23.3.4 was subsequently released, after multiple rounds of internal and external reviews. Block production resumed on September 10, and trading resumed that night.
Liquid stated that as a precautionary measure, while the final phase of the recovery continues, the anchored withdrawal feature remains turned off and node operators have been notified to upgrade.
Alex Thorn, Galaxy's company-wide research director, called the incident "another wave of offensive in our new online reality" in a post on the day the explosion occurred.
