Full Report
Self-described white hats promise to return 'most' of the 4,000 BTC once the vulnerability is fixed
Analysis Summary
# Incident Report: Liquid Network Federation Wallet Exploit
## Executive Summary
Approximately 4,000 BTC (valued at ~$320 million) was drained from the Liquid Network’s federation wallet by individuals claiming to be "white-hat" hackers. The attackers exploited a vulnerability related to the Peg-out Authorization Key (PAK) mechanism to withdraw 95% of the wallet's holdings. The actors have pledged to return most of the funds once a fix is implemented and nodes are patched.
## Incident Details
- **Discovery Date:** Sunday, September 6, 2026 (approximate based on report date)
- **Incident Date:** September 6, 2026
- **Affected Organization:** Liquid Network (developed by Blockstream)
- **Sector:** Financial Technology / Cryptocurrency
- **Geography:** Global / Decentralized
## Timeline of Events
### Initial Access
- **Date/Time:** September 6, 2026
- **Vector:** Exploitation of the Peg-out mechanism.
- **Details:** Attackers triggered an authorized peg-out process through SideSwap to withdraw funds from the federation wallet.
### Lateral Movement
- **Details:** Not applicable in the traditional sense; the attack targeted the bridge infrastructure specifically to facilitate unauthorized transfers.
### Data Exfiltration/Impact
- **Details:** 4,000 BTC was transferred out of the Liquid federation wallet to addresses controlled by the self-described white-hat hackers.
### Detection & Response
- **Detection:** Discovered via on-chain monitoring of the federation wallet.
- **Response Actions:**
- Liquid disabled all bridge nodes.
- Federation members initiated an investigation.
- Exchanges were requested to suspend L-BTC deposits and withdrawals.
- Blockstream established encrypted communication with the attackers via on-chain messaging.
## Attack Methodology
- **Initial Access:** Exploitation of a vulnerability in the Peg-out Authorization Key (PAK) workflow.
- **Persistence:** Not reported; the attack was a discrete set of transactions.
- **Privilege Escalation:** Not applicable; the attackers bypassed authorization checks rather than escalating user privileges.
- **Defense Evasion:** Use of a "white-hat" narrative to potentially delay legal or aggressive technical countermeasures.
- **Credential Access:** The report notes that PAKs did not appear to be "compromised" (stolen), suggesting a logic flaw in how keys are validated or how transactions are authorized.
- **Discovery:** Identifying vulnerabilities in the "latest commit" of the Liquid node software.
- **Lateral Movement:** N/A.
- **Collection:** N/A.
- **Exfiltration:** Automated withdrawal of funds via SideSwap.
- **Impact:** Draining of 95% of the federation wallet's Bitcoin liquidity.
## Impact Assessment
- **Financial:** ~$320 million USD (4,000 BTC) currently held by third parties.
- **Data Breach:** None reported; focused on asset theft.
- **Operational:** Bridge nodes disabled; L-BTC peg-in/peg-out functionality halted.
- **Reputational:** Significant; highlights the security trade-offs of federated sidechains compared to the base Bitcoin layer.
## Indicators of Compromise
- **Network indicators:** Transactions originating from the Liquid bridge to unauthorized Bitcoin addresses (specific hashes not provided in text).
- **Behavioral indicators:** Large-scale peg-out requests through SideSwap exceeding normal operational volumes.
## Response Actions
- **Containment:** Suspension of bridge nodes and L-BTC trading on exchanges.
- **Eradication:** Ongoing development of a software patch to address the "latest commit" vulnerability.
- **Recovery:** Negotiation with the attackers for the return of funds contingent on a successful patch deployment.
## Lessons Learned
- **Key takeaways:** Federated security models are only as strong as the software logic governing the multisig/PAK process; even without key theft, logic flaws can lead to total loss.
- **What could have been done better:** Implementation of circuit breakers or rate limits on peg-outs to prevent the drainage of 95% of a wallet in a single event.
## Recommendations
- **Prevention:** Conduct rigorous third-party audits of the Peg-out Authorization Key (PAK) logic and all recent code commits.
- **Monitoring:** Implement real-time alerts for large-value withdrawals that deviate from historical norms.
- **Governance:** Establish clear protocols for communicating with "white-hat" exploiters to ensure the safe recovery of assets.