Roughly 4,000 BTC, worth about $320 million, were drained from Blockstream’s Liquid Network federation wallet on Sunday afternoon. The attacker obtained 11 of 15 federation signatures to process a regular peg-out request, bypassing the emergency override mechanism entirely. Liquid Network paused its sidechain and disabled bridge nodes after confirming the incident around 4:25pm New York time. Mempool.space’s real-time audit revealed an unauthorized withdrawal of 4,019 BTC, with its dashboard showing only 197 BTC of actual reserves backing 4,205 outstanding LBTC tokens (less than 5% backing). The vulnerability stems from a bug in Elements, an open-source fork of Bitcoin Core maintained by Blockstream, with the code repository last updated in April 2024.
Source: Read the original article
