TREE NEWS update: On Sept 6, an attacker exploited an Elements software bug on Blockstream’s Liquid sidechain to mint ~4,000 LBTC and withdraw ~3,998.5 BTC ($320M) via SideSwap. After returning 3,400 BTC, the attacker retained ~598.5 BTC ($47M). Blockstream is negotiating to recover the remaining funds and has not confirmed the retention as a bug bounty.
Liquid attacker keeps $47M, Blockstream seeks return of 598.5 BTC
This incident highlights the operational fragility of sidechain infrastructure, even when built on established software like Elements. The partial return of funds suggests a negotiation dynamic that could set a precedent for how attackers and protocols handle disputed recoveries in decentralized finance. The unresolved status of whether the retention qualifies as a bug bounty introduces ambiguity around legal and ethical norms for white-hat hacking. What matters next is whether Blockstream's negotiation yields a full recovery and how this shapes security practices for other sidechains relying on similar bridges.
Generated by AI for reference only.
Share on WeChat
Open WeChat → Scan → then tap "…" to send to a chat or Moments.
Tap "…" in the top-right corner to send to a chat or share to Moments.