Hackers have withdrawn ~4k BTC (~$320M) from the Liquid Federation wallet

ffelipelalli about 3 hours ago 38 commentsRead Article on twitter.com

ZH version is available. Content is displayed in original English for accuracy.

https://xcancel.com/Liquid_BTC/status/2096696272447218108

⚡ Community Insights

Discussion Sentiment

17% Positive

Analyzed from 548 words in the discussion.

Discussion (38 Comments)Read Original on HackerNews

cypherpunks01•about 2 hours ago

Seems that an Elements rangeproof cache bug may've gotten exploited. Fix for suspicious issue was committed just last week and attackers could've monitored the public commits and exploited the bug before fix was ever pushed?

Sort of self-fulfilling prophecy if true, that's a leading theory anyhow.

fix: range proof cache bind to asset and scriptpubkey

https://github.com/ElementsProject/elements/commit/c26d719c2...

solenoid0937•36 minutes ago

lmao, PR description says:

> Fixes a number of small issues picked up during LLM scans

Daviey•about 2 hours ago

https://xcancel.com/Liquid_BTC/status/2096696272447218108#m

mitxela•about 2 hours ago

Xcancel is back? When did that happen?

embedding-shape•about 2 hours ago

https://news.ycombinator.com/item?id=49588988 "Nitter and XCancel resume service after legal advice" 5 hours ago

etothepii•about 1 hour ago

Is there any indications that this and the ColdCard heist could in fact be escaped distilled agents from the huggingface and similar attacks?

the_real_cher•5 minutes ago

Now they have 300 million dollars

kennywinker•2 minutes ago

That should keep openai liquid for an extra 45min or so.

skinfaxi•about 2 hours ago

Why do they say it's white hat hackers?

greyface-•about 1 hour ago

While moving the funds, the attackers left an OP_RETURN message with the text "we are whitehats. contact us on chain" https://mempool.space/tx/c103de95817b43f2df635ec6f35ff126ca2...

tom_•about 2 hours ago

Purported white-hat hackers. The implication is that these people are presumably describing themselves as such, but it may not actually be true.

kennywinker•1 minute ago

I can imagine one’s hat changing color when faced with a pot that big…

faitswulff•about 2 hours ago

The same reason scam artists describe themselves as businessmen

simonw•about 2 hours ago

Presumably to try and reduce the chance of a mass panic among their users.

jeremyjh•31 minutes ago

9 times out of 10 when an exchange or broker is "hacked" its been the operators of the exchange.

thephyber•15 minutes ago

You have worded this like a fact, but this is your opinion.

mvdtnz•about 2 hours ago

What do they care if there's a panic? They have "paused the sidechain". No one can act on their panic.

cool_dude85•about 2 hours ago

Wasn't this all supposed to be decentralized? How can a foundation choose to unilaterally "pause the sidechain"?

TZubiri•about 1 hour ago

One disadvantage of decentralized money, criminals gain more power. Many such cases

lmz•13 minutes ago

There are always complaints on here about how Google is only paying $X for vulns. One advantage of decentralized digital money is that its bug bounties are self funding and the payout amount researcher-controlled.

dotancohen•12 minutes ago

That is a natural consequence of banks and governments losing power. That power balance shifts towards the citizens... some of whom are criminals.

The coin fanboys will argue that the bankers and government were criminals as well.

thephyber•9 minutes ago

This is worded in a way that pretends like the banks and governments themselves aren't considered criminals by the masses.

georgemcbay•about 1 hour ago

$320m, not a bad haul.

More than enough to buy yourself a pardon if you get caught.

thephyber•8 minutes ago

And remember that there is precedence for Trump pardoned financial criminals avoiding restitution.

xyst•about 2 hours ago

It’s not "hackers". It’s an inside job, and a rug pull.

Incipient•about 1 hour ago

That's always a possibility, and I'm sure it has happened a lot. I would suspect with the size of liquid it's more likely it was an exploit, but either way I don't think we'll ever know!

jeremyjh•29 minutes ago

Usually we do find out, and in a majority of cases we find out it is a scam by the operators.

fxwin•about 2 hours ago

how is it a rug pull? if it's an inside job, doesn't that just make it theft?

knorker•about 2 hours ago

What's the difference to you between a rug pull and theft?

antonvs•about 1 hour ago

A rug pull involves convincing someone to buy something first.

Theft doesn’t have to involve any convincing.

This is a pretty basic distinction. Perhaps you were thinking of “fraud”?

bagels•about 1 hour ago

A few extra steps. Usually, the rug pull doesn't involve directly taking something that belongs to other people, but instead, selling your own thing in a dishonest way.

s1artibartfast•33 minutes ago

A rug pull means you hype and then sell on the open market without.

mvdtnz•about 1 hour ago

I mean of course it was. Everything in this whole ludicrous space is a scam of one kind or another. It's amazing to me that this is still even a point of discussion. It's obviously a rug pull.

galkk•about 1 hour ago

Time for bitcoin classic++?

gruez•24 minutes ago

Are you thinking of ETH? All the bitcoin classic forks are over various aspect of network rules (eg. block size or block reward), not to roll back a transaction like ETH classic.

medellin•13 minutes ago

Yeah… because in 15 years bitcoin has never forked for a hack. What a brain dead comment