The company said on September 11 that taking assets without authorisation and withholding their return constituted theft rather than responsible security disclosure. It warned that, unless the outstanding bitcoin was returned, it would work with law-enforcement agencies, exchanges, service providers and blockchain forensic specialists to trace the funds and identify those responsible.
About 4,000 BTC was withdrawn from Liquid’s federation reserves on September 6 after attackers exploited a flaw in the transaction-validation software used by the network. The amount was worth roughly $320 million at the time and represented most of the bitcoin held in the federation wallet.
The attackers returned 3,400 BTC the following day, leaving about 598.5 BTC outstanding. The withheld amount was worth roughly $47 million when Blockstream issued its latest statement. The actors had described themselves through messages embedded in Bitcoin transactions as white-hat researchers and sought to retain about 10 per cent of the stolen amount as a bounty.
Blockstream rejected that characterisation. It said its earlier engagement with those responsible had been aimed at recovering user funds and should not be interpreted as acceptance of their actions or the terms they sought to impose.
The company also said it would not establish a precedent under which developers of open-source Bitcoin software could be forced to make ransom payments exceeding their economic participation in a network. It added that users would not be subjected to a reduction in their bitcoin holdings to fund such a payment.
Liquid Network said the exploit did not involve compromised private keys. Instead, the vulnerability affected the way nodes running Elements, the open-source software underlying Liquid, cached verification of range proofs used in confidential transactions.
That flaw allowed the attackers to create about 4,000 units of L-BTC that were not backed by corresponding bitcoin reserves. Those unbacked tokens were then converted through the network’s normal peg-out process into real bitcoin held by the federation.
SideSwap, a Liquid-based settlement service authorised to participate in peg-outs, processed the withdrawals as the forged L-BTC was treated by affected software as valid. Liquid said the peg-out mechanism itself operated as designed once the invalid transactions had been accepted upstream.
The incident drove the federation’s bitcoin reserve sharply lower and prompted operators to halt network activity while the vulnerability was investigated. Block production and ordinary transactions later resumed, but peg-outs remained disabled as a precaution while recovery work continued.
Blockstream released Elements version 23.3.4 as an emergency update to address the proof-verification cache vulnerability. The company also warned users about phishing attempts by impersonators posing as Blockstream or Liquid support staff and directing victims to fake security-update websites.
The Liquid Network is a federated Bitcoin sidechain designed to support faster settlement, confidential transactions and asset issuance while allowing users to move bitcoin between the main Bitcoin blockchain and Liquid through peg-in and peg-out mechanisms. Blockstream acts as its technical provider, while federation members participate in network operations.
The September 6 exploit exposed a software-validation weakness rather than a failure of Bitcoin’s main blockchain. Investigators tracking the event said the stolen bitcoin remained visible on the public ledger, giving exchanges and forensic services the ability to follow subsequent movements.
Blockstream’s September 11 statement marked a shift from the more conciliatory language used during initial recovery efforts, when Liquid referred to the actors as purported white-hat hackers while negotiations were under way.
The company said those discussions were undertaken to protect users and restore network operations, not to legitimise unauthorised withdrawals. It maintained that responsible disclosure did not include taking custody of network reserves or conditioning their return on payment.
Arabian Post – Crypto News Network
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
