Blockstream Refuses Ransom for Bitcoin Stolen From Liquid Network

Key Facts

• Blockstream said it will not pay a ransom for Bitcoin taken from the Liquid Network, rejecting a demand that it fund the shortfall itself.
• About 598.5 BTC, worth roughly $47 million, remains outstanding after the attackers returned 3,400 BTC on Sept. 7.
• Liquid resumed block production and transactions on Sept. 10, but peg-outs stay disabled as a precautionary measure.

Blockstream will not pay a ransom for the Bitcoin (BTC) stolen from the Liquid Network, the company said Friday, rejecting a demand that it cover the 15% of funds the attackers still hold.
The refusal leaves about 598.5 BTC, worth roughly $47 million at the time of writing, outstanding five days after the sidechain was drained.
“Taking assets without authorization and withholding their return is a crime, not responsible disclosure,” Blockstream wrote. “It is not white-hat activity. It is theft.”

The company said it would not accept a precedent under which open-rticipation.”

The attackers had told Blockstream to pay the missing 15% from its own funds as a bug bounty. “You SHALL pay 15% using your own money as bug bounty or you will cause all your holders a 15% loss,” they wrote in an on-chain message.

How the Liquid Network Exploit Worked

Liquid is a Bitcoin sidechain operated by a federation of exchanges and companies, where BTC is locked and reissued as LBTC for faster settlement.

On Sept. 6, a flaw in how Liquid nodes cache range-proof verifications in the open-source Elements software allowed roughly 4,000 LBTC to be created with no Bitcoin behind it, Liquid said in an incident report.
The unbacked tokens were converted to Bitcoin through SideSwap, a federation member holding a peg-out authorization key, and the federation released the funds as authorized. No keys were compromised, Liquid said, and the reserve was drained from about 4,205 BTC to 197 BTC before the network was paused.
SideSwap said in a statement that its authorization key was held online with payouts forwarded automatically, and that the pipeline applied no size or velocity limits.

Liquid Resumes Transactions With Peg-Outs Disabled

Blockstream patched Liquid’s bridge nodes on Sept. 7, and the attackers returned 3,400 BTC to the federation wallet the same day.
An emergency Elements release, v23.3.4, followed multiple rounds of internal and external review. Block production restarted on Sept. 10, and transactions resumed that evening.

Peg-outs remain switched off as a precaution while the final stage of recovery continues, Liquid said, and node operators have been told to upgrade.

Alex Thorn, head of firmwide research at Galaxy, called the episode “another salvo in our new cyber reality” in a post on the day of the exploit.

Read More: Here’s Why Security Audits Alone Aren’t Enough to Protect Your Crypto

This article contains links to third-party websites or other content for information purposes only (“Third-Party Sites”). The Third-Party Sites are not under the control of CoinMarketCap, and CoinMarketCap is not responsible for the content of any Third-Party Site, including without limitation any link contained in a Third-Party Site, or any changes or updates to a Third-Party Site. CoinMarketCap is providing these links to you only as a convenience, and the inclusion of any link does not imply endorsement, approval or recommendation by CoinMarketCap of the site or any association with its operators. This article is intended to be used and must be used for informational purposes only. It is important to do your own research and analysis before making any material decisions related to any of the products or services described. This article is not intended as, and shall not be construed as, financial advice. The views and opinions expressed in this article are the author’s [company’s] own and do not necessarily reflect those of CoinMarketCap.

Source: coinmarketcap.com