Liquid Network $320M Security Incident: Full Investigation
was abnormally withdrawn from the Liquid Network Federation reserve. The attacker exploited an Elements software vulnerability to create L- without real backing, then redeemed it for real through the normal exit process. The attacker claimed to be a "white hat" and returned about 85% of funds after the vulnerability was patched, but approximately 598.5 remains unreturned.
LED-Ger Emergency Warning: Tampered Devices Found
Ledger has confirmed that devices sold through Southeast Asian reseller CryptoBilis contained unauthorized hardware implants that captured users‘ recovery phrases and drained wallets. Over $86 million in crypto has been reported stolen. If you bought a Ledger from CryptoBilis, do not set it up. If already set up, move your funds immediately.
WithdrawnFund Recovery Progress
Returned
598.5 Outstanding
with no real backing enters normal transaction / exit flow flows out of Federation reserve wallet (≈4,000 )Blockstream's official assessment confirms the root cause is a rangeproof cache collision in Elements transaction validation — not a private key leak. No federation keys were compromised.
Attacker exploits the rangeproof cache vulnerability to create unbacked L-, withdrawing approximately 4,000 via normal Peg-out. Reserves drop from ~4,200 to roughly 197 .
Blockstream confirms bridge nodes are patched. Attacker self-identifies as "white hat" via on-chain message, returns approximately 3,400 (85%).
Liquid Network resumes producing blocks and processing transactions, but Peg-out remains suspended.
Peg-out suspension enters its 5th week. Blockstream refuses to pay a 10% bounty, calling the remaining ~598.5 "theft, not responsible disclosure." External audit of Elements v23.3.4 is ongoing. Implied backing ratio ~86%.
Why This Attack Is Particularly Dangerous
- No private key theft or multisig compromise detected
- Attacker exploited asset issuance/validation logic flaw
- Trust chain: reserve → L- → Elements validation → Peg-out
- "Code security" ≠ "asset security"
Current Fund Status
- Initial reserves: ≈ 4,200
- Abnormal withdrawal: ≈ 4,000 (95% of reserves)
- Returned: ≈ 3,400 (~$272M)
- Outstanding: ≈ 598.5 (~$47M)
- Implied backing ratio: ~86%
This incident does not mean the network itself was compromised. What is truly challenged is the trust model between sidechain asset issuance, validation, and redemption.
The Liquid incident reminds the market that when enters other systems through sidechains, wrapped assets, or bridges, the risk investors bear is no longer entirely equivalent to directly holding . The industry needs to re-examine the gap between "code security" and "economic security."
Blockstream has publicly stated: "Taking assets without permission and refusing to return them is a crime, not responsible vulnerability disclosure. This is not white-hat behavior — it is theft." Ledger CTO Charles Guillemet also questioned the "white hat" framing, calling the retention of nearly 600 "more like extortion than white-hat hacking."
Holder Risk Alert
Peg-out remains suspended, and L- cannot currently be redeemed for . The implied backing ratio is approximately 86%, but Liquid has not yet announced a final plan for handling the shortfall. Do not send to the paused Liquid Network, and beware of secondary scams such as "official refunds" or "seed phrase verification."
Recommended balance check: Blockstream Green, Aqua, SideSwap, exchange accounts.
Blockstream has issued a phishing warning: attackers are impersonating Liquid, Blockstream, and support staff to trick users into "migrating funds" or "claiming refunds." Blockstream will never ask for your seed phrase or PIN.
Why Crypto Wallets Get Hacked
Most crypto thefts don't happen because blockchain was broken. They happen because your phone was compromised. Here's what you need to know.
Malware & Spyware
Malicious apps can read your clipboard, capture screenshots, log keystrokes, and steal seed phrases stored on your phone.
Remote Access Trojans
Hackers can remotely control your device, approve transactions without your knowledge, and drain wallets while you sleep.
Phishing & Fake Apps
Fake wallet apps, malicious browser extensions, and phishing links can trick you into revealing your private keys.
Your Phone Is the Weakest Link
Phones are always connected. They run dozens of apps, receive links, scan QR codes, and store sensitive data. A single malicious app or an unpatched vulnerability is all it takes:
- Clipboard hijacking: malware silently replaces the wallet address you copied with the attacker's address.
- Seed phrase theft: if your seed phrase is stored in a photo, note, or password manager on your phone, it can be stolen remotely.
- Overlay attacks: fake login screens appear on top of real apps to capture your credentials.
- SIM swapping: attackers port your number to bypass SMS-based 2FA and reset your accounts.
- Zero-click exploits: some malware can infect your phone without any action from you — just receiving a message or visiting a webpage.
Why Hardware Wallets Keep You Safe
Never Connected to the Internet
Your private keys stay offline at all times. Malware on your phone or computer cannot reach them.
Keys Never Leave the Device
Transactions are signed inside the secure chip. Your seed phrase is never exposed to your phone or computer.
Immune to Remote Attacks
Hackers cannot remotely control, drain, or access a hardware wallet. You must physically confirm every transaction.
You Approve Every Transaction
The device screen shows exactly what you're signing. No hidden approvals, no clipboard hijacking, no surprises.
Built for the Long Term
Hardware wallets are designed for cold storage — ideal for holding and other assets securely for years.
PIN & Passphrase Protection
Even if the device is stolen, your funds remain locked behind a PIN and optional passphrase.
Don't let your phone be your weakest link. Take control of your crypto today.
Trade Securely — Get a Led-ger Peg-out