A whitehat hacker is holding $320 million in drained Bitcoin until developers prove they patched a fatal network flaw
Liquid Network was successfully halted after almost $320 million in Bitcoin left its federation reserve by way of an irregular peg-out.
The incident started Sept. 6 when a buyer submitted 4,000 L-BTC to SideSwap’s peg-out service, which converts Bitcoin represented on Liquid again into BTC on the principle network.
SideSwap said the request handed the conventional authorization course of and prompted the Liquid Federation to launch about 3,996 BTC. The Bitcoin later moved to an deal with that held roughly 3,998.5 BTC on the newest examine.
Liquid disabled its bridge nodes after the withdrawal, whereas SideSwap suspended swaps, peg-ins, and peg-outs. Exchanges additionally paused or ready to pause L-BTC deposits and withdrawals as operators investigated the incident.
The actors controlling the Bitcoin subsequently recognized themselves by way of on-chain messages as “whitehats” and stated they supposed to return a lot of the funds as soon as the underlying bug had been fastened throughout the network.
That prospect might restrict the eventual monetary loss. However, it doesn’t resolve the extra vital query of how virtually 4,000 BTC left the federation with out an obvious key compromise.
The withdrawal seems to have adopted the principles
Liquid and SideSwap say the incident didn’t contain stolen signing credentials.
The withdrawal used SideSwap’s legitimate Peg-out Authorization Key, or PAK, and Liquid stated neither that key nor different federation keys had been compromised.
Instead, SideSwap stated Blockstream traced the 4,000 L-BTC introduced for redemption to a flaw in Elements, the software program underlying Liquid.
If that rationalization is confirmed, the issue occurred earlier than the Bitcoin transaction was signed.
Liquid is designed to take care of one BTC in its federation reserve for each L-BTC in circulation. During a regular peg-out, L-BTC is burned, and an equal quantity of Bitcoin is launched.
In this case, SideSwap says a software program bug created L-BTC with out corresponding Bitcoin backing. Those tokens nonetheless entered a legitimate peg-out course of, after which federation functionaries handled the withdrawal as official and launched actual BTC.
Blockchain safety agency Bitslab said at the very least 11 of Liquid’s 15 functionaries finally signed the transaction.
That factors to a totally different kind of failure from a typical bridge exploit. Secure keys present restricted safety if each signer is introduced with the identical invalid state and accepts it as official.
No impartial technical postmortem or detailed patch description was public on the newest examine, leaving the exact trigger attributed to Liquid and SideSwap.
Whitehats need the bug fastened earlier than returning Bitcoin
Meanwhile, the actors holding the funds have been speaking with Blockstream by way of Bitcoin transactions carrying OP_RETURN messages.
Galaxy Digital analysis head Alex Thorn said Blockstream first despatched a message asking the holder to contact its safety crew. The holder later responded that it deliberate to ship “most” of the Bitcoin again to the federation.
A subsequent message added a situation that Blockstream ought to repair the bug first and guarantee each node is patched earlier than returning the funds.
That places Liquid’s subsequent steps past merely recovering the Bitcoin.
The federation should determine and remediate the Elements flaw, distribute the repair throughout affected nodes, and set up that one other batch of invalid L-BTC can’t cross by way of the identical authorization course of.
It should additionally reconcile the reserve.
The allegedly bug-created L-BTC was burned throughout the peg-out, however about 3,996 actual BTC nonetheless left Liquid’s federation pockets. Until these funds return or the accounting is in any other case restored, the network nonetheless has to exhibit that official excellent L-BTC stays backed one-for-one.
Liquid’s bridge nodes stay disabled whereas that work continues.
While the incident might finally finish with a lot of the Bitcoin recovered, the tougher job is proving that the system which licensed its launch can’t make the identical mistake twice.
The publish A whitehat hacker is holding $320 million in drained Bitcoin until developers prove they patched a fatal network flaw appeared first on CryptoSlate.
