Exchange Ranking
Top Exchanges
24h Volume Ranking
Popularity Ranking
Exchange BTC Balance
Proof of Reserves
Decentralized Exchanges
Funding Rate
Funding Heatmap
Liquidation Data
Max Pain
Long/Short Ratio
Whale L/S Ratio
Binance/Okex/Huobi L/S
Bitfinex Margin L/S
ETF Tracker
Solana ETF
XRP ETF
Hong Kong ETF
Bitcoin Treasuries
Crypto Reversal
Ethereum Reserves
HyperLiquid Wallet Analysis
Hyperliquid Whale Watch
Large Transactions
On-chain Movement
Bitcoin ROI
Stablecoin Market Cap
Options Analysis
News
Articles
Economic Calendar
Features
Wallet
Contract Calculator
Security
Collections
Watchlist
Following
BTC Blockstream sidechain Liquid resumes block production, the aftermath of the hacking incident is still pending
On Thursday, Blockstream's sidechain network Liquid resumed block production. The move comes about four days after a person who called himself a "white-hat hacker" transferred nearly 4,000 bitcoins from his alliance wallet and later returned most of the funds. This restart is crucial for users holding Liquid Bitcoin (L-BTC) or stablecoins.
The fund withdrawal function has been suspended since Sunday. About 600 bitcoins are still in the hands of attackers, resulting in a gap in the reserves to support these coins.
SideSwap's withdrawal key was used but not stolen
In a status update released at 10:00 Coordinated Universal Time (UTC), the @Liquid_BTC account stated that as a precautionary measure, block production has resumed in a "no transaction" state so that the team can monitor the overall stability of the network. Currently, Liquid's bridge nodes and functional nodes have been launched with necessary software patches. Functional nodes are signing and verifying blocks as expected.
However, Peg operations were temporarily closed while the Network was rebuilding its BTC to L-BTC reserve. It all started on Sunday, September 6, when hackers claiming to have "white hat" identities extracted about 4,000 bitcoins (worth about $320 million) from the Liquid Alliance wallet, accounting for about 95% of the wallet's ~4,200 bitcoins balance. At the time, it was reported that the withdrawal used SideSwap's anchored exit authorization key, but the key itself was not stolen.
Blockstream later said the problem originated from a vulnerability in Elements, the open source software that supports Liquid, that allowed invalid L-BTC to be created and redeemed through the normal path as if it were fully backed by reserves. The team released an emergency fix version of Elements v23.3.4 the day before the reboot, closing theft-related attestation verification vulnerability by hardening the cache key used for attestation of scope.
Adam Back promised to anchor the mechanism, but gave no timetable.
After stating on the Blockstream release chain that "the bridge node has been repaired and funds can be safely returned," relevant actors returned 3,400 bitcoins (worth approximately US$269.2 million at the September 7 exchange rate). This leaves approximately 598.5 bitcoins unreturned, with a gap of approximately US$46 million to US$47 million based on current prices.
On September 9, the anonymous hacker publicly criticized Blockstream's money management methods, accusing the company of allocating only $1.5 million to protect $5 billion worth of assets. "Your dereliction of duty is obvious," the hacker wrote, warning that unless a 10% vulnerability bounty is paid, the remaining coins will remain missing. "You must pay 10% of your own money as a loophole bounty, otherwise you will cause all your holders to suffer a 15% loss due to your irresponsibility and misgivings."
Adam Back, founder and CEO of Blockstream, assured holders that L-BTC's anchored mechanism will be redeemed one-on-one, which means users can exchange tokens for the same number of base-layer bitcoins. "Don't panic over-the-counter selling," Back wrote on X. But he did not say how the gap of about 600 bitcoins would be filled when the anchor exits and reopens, nor did he provide a timetable for resuming the anchor input and output services.
The network was updated again in about 10 hours. A status update released at 19:55 UTC confirmed that transactions have resumed, but the anchored exit feature is still not available.
