Blockstream has made its latest statement regarding the recent security incident involving Liquid Network. The company disclosed that it will not pay a ransom to retrieve the approximately 598.5 bitcoins still under the control of the attackers and stated that if the relevant assets are not returned, it will seek available legal avenues to continue pursuing compensation.
Nearly 600 BTCs have still not been returned.
This incident occurred on September 6th and involved the Bitcoin sidechain Liquid Network developed by Blockstream. The attackers exploited a vulnerability to mint approximately 4,000 L-BTC coins that were not fully backed by BTC, and then exchanged them for real Bitcoin in the Liquid Federal Reserve through the peg-out infrastructure of SideSwap.
According to the design, each L-BTC in circulation on Liquid should be supported by a federal-hosted wallet with a 1:1 reserve of BTC. At the time of the incident, this federal wallet held approximately 4,200 BTC, which means that the attack drew about 95% of the reserves at one point. Calculated at the then price, the amount involved was roughly 320 million US dollars.
Subsequently, on September 7th, the attacker returned approximately 3,400 BTC, which accounts for about 85% of the total amount that was transferred away. However, there are still around 598.5 BTC remaining in their control address and have not been returned yet.
The company claims that it does not constitute white-hat behavior.
Blockstream indicates that this incident does not constitute responsible disclosure, nor should it be regarded as white-hat behavior. The company stated that unauthorized transfer of assets, coupled with pressure exerted under the condition of non-return, is essentially theft, and not security research.
The company also stated that they had previously contacted the relevant parties in good faith, hoping to facilitate the return of users' funds, but they would not pay any compensation for the "return of stolen property." Blockstream believes that allowing the attackers to retain such a large amount of funds would set a bad precedent for Bitcoin open-source developers and related projects.
The vulnerability has been fixed, and the network has resumed block generation.
At the mitigation level, Blockstream has released Elements and v23.3.4 to fix the vulnerabilities that were exploited this time. Liquid Network has now been restored to normal operation.
Samson Mow, which previously provided continuous updates on the progress of the event, indicates that the processing of Liquid transactions has basically returned to normal. However, before approximately 598 remaining BTC are recovered, the current reserve support ratio for L-BTC is still only around 85%.
- Abnormal casting scale of approximately 4,000 L-BTC
- Approximately 3,400 BTC have been returned.
- Approximately 598.5 BTC have not yet been recovered.
Additional information:Blockstream also emphasizes that Bitcoin transaction records will be permanently retained on the public blockchain, and the related transfers will not disappear; the traces on the chain will also continue to exist. The company stated that if the other party is willing to return the remaining assets, there is still a chance to resolve the incident without further escalation.
