Blockstream confirms bridge nodes patched, funds safe to return after $320M Liquid Network exploit

Blockstream announced on September 7 that its Liquid Network bridge nodes have been patched and secured, clearing the way for the return of approximately 4,000 BTC, worth around $320 million, that were fraudulently drained from the Liquid Federation wallet a day earlier. The exploit, which stemmed from a bug in the Elements software underpinning the Liquid sidechain, allowed an attacker to trigger a valid peg-out using invalid L-BTC. The federation’s automated systems couldn’t tell the difference. What happened on September 6 The attacker exploited a vulnerability in the Elements code to abuse SideSwap’s Peg-out Authorization Key, or PAK. That key is part of the mechanism that converts L-BTC (the Liquid sidechain’s wrapped Bitcoin) back into native BTC on the main Bitcoin blockchain. The result was catastrophic for the federation’s reserves. Before the exploit, the Liquid Federation wallet held more than 4,200 BTC. After it, that figure cratered to roughly 197 BTC. That math means L-BTC was suddenly, dramatically under-collateralized. For every L-BTC token circulating on the Liquid Network, there was supposed to be one real BTC backing it. After the exploit, less than 5% of that ba...