The Liquid Network has gradually resumed operations after a major hack that drained approximately $320 million from its federation wallet. According to AMBCrypto, block production resumed on September 10th, with functionary nodes successfully signing and validating blocks. However, the network initially kept transactions disabled during the monitoring stage to ensure stability. By later in the evening, transactions had resumed, allowing users to once again transact with assets already on Liquid. This recovery represents a significant milestone in the network's return to normal operations, though full functionality has not yet been restored.
Despite the operational restart, Liquid Network has implemented several security measures to prevent future attacks. As reported by AMBCrypto, peg-outs, the process of moving LBTC from Liquid to the Bitcoin network, have been disabled intentionally to ensure safety and avoid another attack. This means that while users can now make transactions within Liquid, they cannot withdraw their LBTC back to the Bitcoin main chain through the normal peg-out process. Blockstream is likely to keep this function disabled until it is confident of the Liquid network's internal state and ensures that BTC/LBTC reserves have been correctly restored and verified. The caution stems from a proof-verification cache vulnerability that affected Liquid's underlying Elements software, which was fixed through the Emergency Elements v23.3.4 release that strengthens cache keys used when verifying range proofs.
Blockstream has categorically refused to pay ransom for the remaining Bitcoin, stating that paying would create a bad precedent for open-source software developers. As reported by TradingView News, the company declared that taking assets without authorization and withholding their return constitutes theft, not responsible disclosure. Blockstream emphasized that negotiations were conducted solely to recover user funds and should not be interpreted as accepting the attackers' actions or demands. The company has promised to assist law enforcement, exchanges, and Bitcoin blockchain investigators to locate the unseized Bitcoin and trace the attackers responsible for the theft. According to TradingView News, the hackers demanded that Blockstream pay a 10% bounty from its own funds in an onchain message shared by Jan3 CEO and former Blockstream chief strategy officer Samson Mow on Wednesday, warning that Liquid holders would otherwise face a 15% loss. In its latest statement, Blockstream warned that allowing such large-scale theft would create a damaging precedent for Bitcoin and open-source developers, stating it will not pay for the return of stolen property.
The recovery process has shown significant progress, with approximately 85% of the Bitcoin withdrawn during the incident now restored. As reported by AMBCrypto, the incident began when attackers discovered a flaw in software used by Liquid, a Bitcoin-based network designed for faster transfers and financial services. Through this weakness, around 4,000 Liquid Bitcoins were generated and subsequently exchanged for real Bitcoin on the network. The attackers described their actions as 'white-hat' activity, and approximately 3,400 BTC was returned afterwards. This represents a positive turn after the white-hat hackers returned 3,400 BTC, worth about $268 million. However, approximately 598.5 BTC has been kept in a separate wallet as an unofficial bounty, with Blockstream stating there is still an opportunity to resolve this responsibly while simultaneously threatening coordinated tracing efforts with law enforcement and forensic teams.
