The Liquid Network, a Bitcoin sidechain developed by Blockstream, has paused operations after hackers exploited a consensus bug to withdraw approximately 4,019 BTC worth $320 million.

Key Points

• Hackers exploited an inflation bug on the L-BTC sidechain to create unauthorized tokens and redeem them for 4,019.4 BTC on the main chain.
• The unauthorized transaction bypassed security safeguards by appearing valid under compromised consensus rules, leading federation members to sign the withdrawal.
• Blockstream disabled bridge nodes and paused the sidechain, leaving only 207 BTC in the treasury compared to the original 4,200 BTC.
• The attackers left messages in the transaction data claiming to be "whitehats" and provided contact information for potential negotiations.
• Exchanges and wallet providers have suspended L-BTC deposits and withdrawals, causing significant service disruptions for users.

Why it Matters

This incident highlights the inherent risks of federated sidechains that rely on trusted intermediaries rather than the trustless, transparent model of the main Bitcoin blockchain. The breach raises serious concerns regarding the security of custodial systems and the potential for permanent loss of funds when consensus mechanisms are compromised.