A white-hat actor has returned 3,400 Bitcoin worth about $268 million to the Liquid Federation after exploiting a vulnerability. The actor still holds 598.5 BTC worth roughly $47 million.
CertiK Alert reported the transfer on September 7 after the actor communicated with Blockstream about the incident. The returned Bitcoin represents most of the nearly 4,000 BTC involved in the exploit.
Blockstream Confirms Security Fix
The actor asked Blockstream to fix the vulnerability before returning the Bitcoin. They also requested confirmation of the address that would receive the funds.
Related: Zondacrypto Probe Adds Fifth Suspect in Fraud Case
Blockstream later said it had patched the affected bridge nodes. In an on-chain message, the company told the actor, “Bridge nodes are patched, safe to return the funds.”
The actor subsequently transferred 3,400 BTC back to the federation after a series of on-chain messages between both sides.
Elements Bug Triggered Bitcoin Withdrawal
The incident began on September 6, when nearly 4,000 BTC left a Liquid Federation wallet. Liquid linked the withdrawal to SideSwap’s Peg-out Authorization Key, or PAK.
Liquid said the PAK and other federation keys were not compromised. Blockstream later identified a bug in Elements, the open-source software that powers Liquid, as the source of the vulnerability.
CertiK said the remaining 598.5 BTC “could potentially be a bounty reward.” However, no formal agreement confirming a bounty has been disclosed.
Related: Bitcoin Theft Suspect Malone Lam Set to Plead Guilty in $240M Case
Disclaimer: The information presented in this article is for informational and educational purposes only. The article does not constitute financial advice or advice of any kind. Coin Edition is not responsible for any losses incurred as a result of the utilization of content, products, or services mentioned. Readers are advised to exercise caution before taking any action related to the company.
