Liquid hacker keeps 598 BTC after negotiations stall

A single sad-face emoji ended negotiations for $48 million in stolen Bitcoin.

The attacker who drained 4,000 BTC from Blockstream's Liquid Network returned 3,400 BTC after nodes patched a critical bug, retaining 598.5 BTC as an unnegotiated finder's fee. On-chain logs revealed Blockstream attempted to push back against the 15 percent ransom using encrypted messages before the hacker abruptly ended communication. According to David Bennett on Bitcoin And, automated AI tools are accelerating this dynamic by scanning open-source code repositories continuously, building exploits faster than human engineering teams can patch them.

The breach stemmed from a caching shortcut in Elements, the underlying software backing the Liquid sidechain. On Ungovernable Misfits, hosts q and a detailed how Liquid relies on range proofs to verify hidden confidential transaction values. To save processing time, the validation code cached successful proof checks - but failed to record crucial context like asset types or spending conditions. That missing data allowed an invalid proof to pass validation checks.

Once the faulty proof cleared node software, exchange bridge SideSwap accepted 4,000 forged LBTC and routed them into the standard peg-out pipeline. Eleven federation signers authorized the transfer because their nodes relied on the software's corrupted consensus view. The exploit stripped almost all real Bitcoin reserves from the sidechain, leaving roughly 200 BTC on the network.

The flaw was visible in public code records long before the attack. Independent analyst Orange Surf noted that a pull request resolving the caching logic had sat unmerged on GitHub since early September. The attacker struck after the fix was submitted but before node operators merged it into production. On Ungovernable Misfits, host Max expected the hacker to keep the full balance, while q and a held out hope for a white-hat return prior to the partial refund.

This gap between vulnerability discovery and software deployment is fueling wider industry panic. On Bitcoin And, Bennett pointed to rising friction between hardware wallet manufacturers and independent researchers. Ledger CTO Charles Guillemette and Trezor head of security Jan Komarek are pushing for strict 90-day private disclosure windows, warning that AI tools now allow amateur researchers to discover edge-case flaws and leak unpatched code for online clout.

Centralized software consensus broke multi-signature security in seconds. As AI tools lower the barrier for exploit generation, protocols running unpatched code will keep paying the price.