Ethical Hacking News
In a shocking turn of events, hackers drained $320 million from Liquid Network, then returned most of it, but the incident has raised questions about the morality and legality of the hackers' actions. Will the attackers be hailed as "white-hat hackers," or will their actions be deemed extortion? The complexities of this incident highlight the need for robust security measures and a stronger focus on bug discovery and patching.
The Liquid Network, a crypto exchange and sidechain, faced a cyber attack resulting in the theft of approximately $320 million. Hackers, identifying themselves as "white-hat hackers," demanded Blockstream fix a vulnerability before returning stolen funds. The attackers returned 3,400 BTC worth $262.6 million, but kept 598 BTC worth $47 million for themselves. Debate surrounds the morality and legality of the hackers' actions, with some hailing them as "white-hat hackers" while others view it as extortion. Experts argue that unauthorized access to someone else's wallet, even for bug discovery, is not legally justified. The incident highlights the need for robust security measures, prioritizing bug discovery and patching, to prevent similar vulnerabilities in the future.
Liquid Network, a prominent crypto exchange and sidechain built by Blockstream, recently faced an unprecedented cyber attack that resulted in the theft of approximately $320 million. The attack, which occurred on September 6, 2026, saw hackers drain roughly 4,000 out of the 4,200 Bitcoin sitting in the federation wallet. However, in a surprising turn of events, the attackers returned 3,400 of those crypto coins, worth around $262.6 million, while keeping roughly 598 BTC, close to $47 million, for themselves.
The attackers, who identified themselves as "white-hat hackers," initially demanded that Blockstream fix the underlying vulnerability that led to the theft. They claimed that they would return the stolen funds if the vulnerability was patched and every node was updated to the latest security patch. Blockstream's confirmation that the affected bridge nodes had received the security patches prompted the attackers to return 3,400 BTC to the federation wallet. The remaining 598 BTC were effectively kept by the attackers, who could be seen as "rewarding" themselves for the bug discovery.
The nature of the attack and the attackers' demands have sparked intense debate about the morality and legality of the hackers' actions. While some have hailed the attackers as "white-hat hackers," others argue that exploiting a vulnerability, draining $320 million, and demanding a fix before returning the money still constitutes extortion, potentially carrying felony charges and prison sentences up to 20 years in the US.
Security specialist Alena Vránová pushed back hard against the framing of the attackers as "white-hat hackers," arguing that unauthorized access to someone else's wallet, even if done to fix a bug, does not make it legal. Nicolas Burtey, the founder of Galoy, echoed this sentiment, stating that even if the funds are returned in full, the attack has already damaged trust in Liquid. The federated system promises one-to-one Bitcoin backing for every L-BTC token, but this guarantee can fail, and recovering most of the funds does not erase that failure.
The incident highlights the complexities of cybersecurity and the blurred lines between good and bad. It also underscores the importance of robust security measures and the need for organizations to prioritize bug discovery and patching. The Liquid Network incident serves as a wake-up call for the crypto community to strengthen their security protocols and ensure that such vulnerabilities are not exploited in the future.
Related Information:
https://www.ethicalhackingnews.com/articles/Unprecedented-Crypto-Heist-Liquid-Networks-320-Million-Drain-and-the-Complexities-of-White-Hat-Hackers-ehn.shtml
https://securityaffairs.com/198697/cyber-crime/hackers-drain-320-million-from-liquid-network-then-return-most-of-it.html
Published: Tue Sep 8 17:44:05 2026 by llama3.2 3B Q4_K_M
