As of Monday, after what they claim are white-hat hackers withdrew most of the reserves two months ago, the Bitcoin reserves of Liquid Network have been fully restored.
The alliance stated that it has re-established a 1:1 bitcoin collateral for all LBTC. LBTC is a token on Liquid that represents bitcoin. It mentioned that this progress was achieved a few weeks ago after the participants restored the 1:1 exchange ratio between BTC and LBTC.
Liquid Federation wrote in the update:
Liquid Federation is pleased to announce that the Bitcoin reserves on the network have been fully restored, and a 1:1 BTC collateral has been re-established for all LBTC.
"This follows the exchange and recovery between BTC and LBTC a few weeks ago, after which... was allowed again..."
Blockstream The Chief Executive Officer Adam Back posted a screenshot of a web dashboard on X, showing that the asset-liability matching ratio is 100% and the reserve gap is 0.00 BTC. The alliance stated that users running their own Liquid nodes can directly verify the federal reserves.
The alliance did not explain how the gap caused by the vulnerability was filled.
Liquid was launched in 2018 by Blockstream. It is a Bitcoin sidechain, an independent blockchain that operates in parallel to Bitcoin, aimed at providing faster and more private transactions. Users lock BTC in wallets controlled by a federation consisting of a group of exchanges and other cryptocurrency companies that operate the network, in exchange for an equivalent amount of LBTC.
When asked on X what could prevent similar attacks from happening again, Back listed three reinforced “lines of defense”: the updated peg-out authorization keys are now stored in cold storage hardware wallets; proof-of-work verification caching has been disabled, and a vulnerability in the nodes has been fixed; the consensus rules have also been strengthened to “fail closed”. He said that the network has also undergone multiple third-party audits.
Back wrote: 'There's another lesson to learn: be skeptical about the fixes suggested by AI (don't trust them blindly; verify them instead).'
On October 20th, during an interview with Bloomberg TV, Back mentioned the growing role of AI in the security field, stating that there has been "a wave of AI-assisted security analysis" in the past few months. He said, " AI is certainly a tool to help develop and protect code, but it can also be used to identify vulnerabilities," and added that this has "affected many companies in the industry." At that time, he indicated that the funds involved in hacking were still "under investigation."
The alliance stated that it is modernizing the governance structure of Liquid, clarifying responsibilities and supervision, and adding more technical and operational safeguards. More details will be announced in the coming weeks.
September Vulnerability Incidents
On September 6th, a self-proclaimed white-hat hacker withdrew approximately 4,000 BTC from the federal wallet with the ID Liquid, which was worth about 320 million US dollars at the time. The hacker communicated with Blockstream by embedding a PGP signature message within a Bitcoin transaction.
The next day, after the bridging node represented by Blockstream (which connects to Liquid) had been patched, they returned 3,400 BTC tokens, valued at approximately $269 million, but still retained about 598 BTC tokens. The chief technology officer of Ledger, Charles Guillemet, stated that if the remaining tokens were intended as negotiation rewards, then such an arrangement would "seem more like extortion than the behavior of a white-hat hacker."
Blockstream subsequently refused to pay a ransom for the remaining bitcoins. The company stated, "Taking assets without authorization and refusing to return them is a crime, not responsible disclosure. This is not white-hat behavior. This is theft."
