Bitcoin BTC$77,937.78 worth millions of dollars were withdrawn from a settlement network used by cryptocurrency exchanges, marking the latest in a string of security breaches that have plagued the market this year.
The alleged "white hat hacker" is reportedly attempting to act ethically by offering to return the stolen funds once the vulnerability is fixed.
Liquid Network, launched in 2018 by Blockstream, said purported “white-hat hackers,” removed roughly 4,000 of the 4,200 bitcoin held in its federation wallet. The network is overseen by a federation of more than 80 exchanges, infrastructure firms and asset managers.
“Liquid wallets will be impacted, and we’re sorry for any inconvenience,” Liquid Network said on X, halting all new transactions. “Federation members are actively working on resolving this so we can restore normal network activity.”
The sidechain halted new transactions and warned that wallets would be disrupted while federation members work to restore service. The episode matters because Liquid was built to solve a practical problem for exchanges, mainly the slow speed of the Bitcoin blockchain. To solve that, the network issues L-BTC against bitcoin locked in reserve so trades can settle faster. A drain of nearly the entire reserve raises doubts about the security of that model.
The theft didn’t occur because a password or private key was compromised, the method behind most crypto hacks this year. Instead, the stolen funds moved out through SideSwap, a normal and approved trading platform.
Later, Blockstream found that a software bug had created some of the bitcoin involved in a system called Elements. SideSwap said it couldn’t tell which coins came from the bug and which were real, so it treated them all the same. Other types of assets on the same network (Liquid) were not affected.
A white hat hacker is an ethical hacker who exploits a flaw in a protected system before malicious actors can. They typically exploit a flaw, move the money and seek a fee to return it.
The flaw in this case, according to security specialists, is at the node level in Liquid’s transaction software, not a breach of keys or hardware modules.
According to latest reports, the hacker is communicating with network maintainers through onchain Bitcoin transactions, promising to return the money once the vulnerability is fixed.
“Please fix the bug first. The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix,” one message said.
The theft follows a $6 million drain last week from a lending platform linked to Crypto.com and an August breach involving the Coldcard hardware wallet. Liquid has not said when the network will reopen or whether the bitcoin will be returned.
Source
This article is syndicated for educational reading. For the latest updates, visit the original publisher.
Read on coindesk.com
