Bitcoin network used by exchanges hit by $320 million exploit. Hackers claim they're the 'good guys'

Bitcoin $BTC$79,647.57 worth millions of dollars were withdrawn from a settlement network used by cryptocurrency exchanges, marking the latest in a string of security breaches that have plagued the market this year.

Liquid Network, launched in 2018 by Blockstream, said purported “white-hat hackers,” removed roughly 4,000 of the 4,200 bitcoin held in its federation wallet. The network is overseen by a federation of more than 80 exchanges, infrastructure firms and asset managers.

“Liquid wallets will be impacted, and we’re sorry for any inconvenience,” Liquid Network said on X, halting all new transactions. “Federation members are actively working on resolving this so we can restore normal network activity.”

The sidechain halted new transactions and warned that wallets would be disrupted while federation members work to restore service. The episode matters because Liquid was built to solve a practical problem for exchanges, mainly the slow speed of the Bitcoin blockchain. To solve that, the network issues L-$BTC against bitcoin locked in reserve so trades can settle faster. A drain of nearly the entire reserve raises doubts about the security of that model.

The theft didn’t occur because a password or private key was compromised, the method behind most crypto hacks this year. Instead, the stolen funds moved out through SideSwap, a normal and approved trading platform.

Later, Blockstream found that a software bug had created some of the bitcoin involved in a system called Elements. SideSwap said it couldn’t tell which coins came from the bug and which were real, so it treated them all the same. Other types of assets on the same network (Liquid) were not affected.

A white hat hacker is an ethical hacker who exploits a flaw in a protected system before malicious actors can. They typically exploit a flaw, move the money and seek a fee to return it.

The flaw in this case, according to security specialists, is at the node level in Liquid’s transaction software, not a breach of keys or hardware modules.

The theft follows a $6 million drain last week from a lending platform linked to Crypto.com and an August breach involving the Coldcard hardware wallet. Liquid has not said when the network will reopen or whether the bitcoin will be returned.