Hacker Steals 4000 BTC Without Password

A hacker has stolen approximately 4000 BTC from the Bitcoin sidechain Liquid Network without using a password or private key. The attacker exploited a vulnerability in the network's transaction verification program, causing 'non-existent assets' to be recognized as 'valid assets.' As a result, they obtained Bitcoin through normal withdrawal procedures. According to blockchain analysis firm TRM Labs, about 3996 BTC was stolen, equivalent to approximately $319 million at the time. The attacker later returned 3400 BTC, but 600 BTC remains unreturned. Liquid is a Bitcoin sidechain developed by Blockstream, where depositing Bitcoin results in the issuance of an equal amount of L-BTC. The attacker took advantage of a flaw in the open-source program Elements' 'Rangeproof Verification Cache' to confuse unverified transactions with valid ones. This attack is believed to have been prepared through a rehearsal, with 3996.02 BTC moved through normal procedures in just 36 minutes. The automated withdrawal structure of SideSwap has also been pointed out as a contributing factor to the damage. Blockstream has stated that they have resolved the issue by changing the cash structure.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.