Two months ago, a bug in the software behind the Liquid Network let an attacker mint about 4,000 LBTC tokens backed by nothing at all, then swap them for real bitcoin worth roughly $320 million. Liquid is a Bitcoin sidechain run by a federation of companies led by Blockstream, and it exists to move bitcoin faster and more privately than the main chain allows. The attack drained the federation wallet from about 4,205 bitcoin down to 197, leaving the tokens that traders and exchanges rely on backed by almost nothing. On Monday, the Liquid Federation announced the hole is closed and every LBTC is backed one-to-one again, which is good news for anyone holding the token. The part that deserves a closer look is how the hole got closed, because the attacker never gave all the money back.

The white hat who kept $47 million

The attacker called themselves a white hat and left a message in a Bitcoin transaction saying exactly that, then returned about 3,400 bitcoin the day after the attack, once Blockstream said the bridge nodes had been patched. What stayed behind was roughly 600 bitcoin, worth about $47 million at current prices, and the attacker wanted a 10 percent bug bounty in exchange for handing it over. Blockstream said no, and said it plainly: taking assets without authorization and refusing to return them is a crime, not responsible disclosure, and this is theft, not white-hat behavior. The company refused to pay a ransom for the remaining coins, and the money stayed gone. That refusal is the reason the federation had to find about 600 bitcoin somewhere else to make LBTC whole again.

Blockstream wrote the check

The money came from Blockstream itself, according to Samson Mow, a Liquid Federation board member, who identified the company as the source of the deposits that closed the gap. The deposits arrived in pieces, with about 50 bitcoin landing on October 28, then 300 bitcoin and a final 250 bitcoin on November 2, and the federation announced full backing the same day. Adam Back, the chief executive of Blockstream, posted a screenshot of the network dashboard showing assets matching liabilities at 100 percent, with a reserve deficit of exactly zero. SideSwap, one of the federation members, reported about 4,270 bitcoin in reserve against the same amount of LBTC on November 3. The bug itself was fixed quickly, with a patched version of the Elements software released on September 9, three days after the exploit, and Blockstream said no private keys were lost and none of the network operators were hacked.

What is still not back to normal

Full backing does not mean everything is back to the way it was, because direct withdrawals from the federation are still restricted, and users have had to swap bitcoin and LBTC through participating providers for weeks instead of using the network's own peg-out path. The federation has not said when those restrictions will lift, and the announcement this week did not address it either. There is also the question of who exactly paid for what, since the blockchain shows the deposits arriving but does not name the people behind them, and only Mow has pointed at Blockstream in public. For LBTC holders, the practical result is the same either way: the token is backed again, and the sidechain survived an attack that took about 95 percent of its reserves in a single day. For everyone else, the story is a reminder that the words white hat and hacker can describe the same person on the same day, and the difference between a rescue and a robbery can come down to how much money comes back.

Liquid is whole again, and that matters, because a sidechain that loses its backing and never gets it back is finished. Blockstream paid roughly $47 million to make that happen, refused to call a thief a white hat, and got its network back to full backing in about two months. The lesson for anyone holding tokens on a sidechain or a bridge is simple enough: the peg is only as strong as the people standing behind it, and this time the people behind it paid up. The attacker, meanwhile, is still holding about 600 bitcoin, and nobody knows who they are.

-------
Author: Cedric Holloway
New York Newsroom
GlobalCryptoPress | Breaking Crypto News