Hacker extracts $48M extortion fee from Liquid network
- An attacker drained 4,000 Bitcoin from Blockstream's Liquid network using a faulty software validation cache.
- The hacker returned 85 percent of stolen funds while keeping 598.5 Bitcoin as a $48 million ransom.
- All 15 federation nodes authorized the fraudulent transfer because every signer ran identical unpatched code.
A single cached code shortcut wiped out sidechain reserves.
An attacker exploited a software flaw in the Elements consensus engine powering Blockstream's Liquid Network, generating $320 million in tokenized Bitcoin out of thin air. Liquid relies on confidential transactions protected by mathematical range proofs. To save processing time, validation code cached successful proof results but failed to record spending conditions or asset types. That loophole allowed an invalid proof to pass consensus checks cleanly.
The attacker routed 4,000 forged LBTC through SideSwap, a federated swap operator operating without withdrawal limits or identity verification. Independent analyst Orange Surf noted that developers had already written a patch for the caching logic in a public pull request. That fix sat unmerged on GitHub for weeks before the exploit occurred.
"Centralized software consensus broke multi-sig security in seconds."
- Ungovernable Misfits
Once the peg-out completed, the attacker initiated encrypted on-chain negotiations over the Bitcoin blockchain. Claiming white-hat status, the hacker eventually returned 3,400 Bitcoin to the network. However, they kept 598.5 Bitcoin - worth roughly $48 million - as an unnegotiated finder's fee, ending the conversation with a single sad-face emoji when Blockstream pushed back.
The breach exposed critical structural weaknesses in federated multisig custody. Eleven federation signers blindly approved the fraudulent withdrawal because every node ran identical, unpatched software. The federation trusted software updates without independent code audits, creating a single point of failure across the entire signing quorum.
On Bitcoin And, host David Bennett warned that automated scanning tools are rapidly altering protocol security. Malicious actors now use automated tools to scour open-source repositories, assembling functional exploits faster than human engineering teams can deploy defensive patches.
"Automated tools now scan code repositories continuously to construct exploits faster than human auditors can identify flaws."
- David Bennett, Bitcoin And
Federated custody promised security through distributed signers. When every signer runs identical flawed code, distribution offers no protection at all.