Threat Intelligence & APT SecurityWeek 1 month ago

Hackers Return $263 Million Stolen From Liquid Network

CN
CyberNew Threat Research Desk
• Original Reporting: SecurityWeek
CyberNew Threat Intel Assessment
Assessed Severity: INFORMATIONAL
Impacted Surface
Enterprise Perimeter & Network Defense
Intelligence Sector
Threat Intelligence & APT

Analyst Takeaway

"Alleged ‘white-hat’ hackers have returned 3,400 Bitcoin (worth approximately $262.6 million) of the 4,000 Bitcoin (~$320 million) stolen from the Bitcoin sidechain Liquid Network over the weekend. The Blockstream-developed sidechain disclosed the incident on Sunday, after disabling its nodes and suspending all transactions in response to the heist. “Exchanges have been notified and have already..."

Recommended Defense & Mitigation

  • Threat Monitoring: Ingest published IOCs into SIEM/EDR detection rules for continuous telemetry monitoring.
  • Security Awareness: Alert staff and maintain baseline endpoint hardening across endpoints.
Curated & Verified by CyberNew Threat Intelligence Desk Standard Defense Framework (NIST / MITRE ATT&CK)
Cybercrime takedown

Alleged ‘white-hat’ hackers have returned 3,400 Bitcoin (worth approximately $262.6 million) of the 4,000 Bitcoin (~$320 million) stolen from the Bitcoin sidechain Liquid Network over the weekend.

The Blockstream-developed sidechain disclosed the incident on Sunday, after disabling its nodes and suspending all transactions in response to the heist.

“Exchanges have been notified and have already paused (or will pause) LBTC deposits and withdrawals. Other Liquid assets such as USDT, DePix, and RWAs are unaffected by this security incident,” Liquid said.

The funds were drained from Liquid’s federation wallet, which held approximately 4,200 Bitcoin before the attack. However, it is unclear how the funds were stolen.

“What we know so far is that the funds were withdrawn via the SideSwap PAK (Peg-out Authorization Key), but that key was not compromised, nor were any others,” Liquid said.

“Liquid wallets will be impacted, and we’re sorry for any inconvenience. Federation members are actively working on resolving this so we can restore normal network activity,” it added.

Advertisement. Scroll to continue reading.

Written By Ionut Arghire

Source Verification & Original Intelligence

This threat report was reviewed by CyberNew analysts and cross-referenced with primary security disclosures from SecurityWeek.

Primary Advisory →