What happened
Approximately 4 000 BTC reached the attacker's address, even though Liquid employs a withdrawal restriction based on authorized addresses.
Why it matters
The case highlights a potential gap between formal withdrawal restrictions and actual user fund protection, but available data does not yet reveal the attack mechanism.
According to Unchained's report, approximately 4 000 BTC ended up at the attacker's address, notwithstanding Liquid's rule limiting withdrawals to addresses linked to registered authorization keys. Liquid's documentation describes this mechanism as protection against the redirection of user funds to malicious actors.
Alex Thorn, Head of Research at Galaxy, stated that this restriction did not apply to the individuals who withdrew the bitcoins. Consequently, the described incident raises questions about which specific part of the operation was covered by the authorized address rule.
The practical significance of this story depends on the details of the attack: from the available package, it is unclear which credentials or withdrawal stages were compromised and why the control failed. The next significant signal will be an explanation from Liquid and confirmation of the fund movement route.
Confirmed facts
- Unchained reported that approximately 4 000 BTC reached the attacker's address.
- Liquid restricts bitcoin withdrawals to addresses associated with registered authorization keys.
- In Liquid's documentation, this control is described as a means to prevent redirecting user funds to an attacker.
- Alex Thorn, Head of Research at Galaxy, stated that the restriction did not extend to the people who took the bitcoins.
- The source package presents one independent publication in metadata format, without primary confirmation.
Context
The story is based on an independent publication by Unchained and its metadata synopsis; the full text of the material and primary comments are not included in the package.
What remains unknown
- How exactly did the attacker gain the ability to withdraw funds outside the authorized address rule?
- Has Liquid confirmed the incident and the claimed volume in bitcoins?
- Which stages of the operation were covered by the restriction and which remained outside its scope?
- Is there independent confirmation of the fund movement route?
Editorial context
Confidence: medium
If the description of the incident is confirmed, attention will shift to the boundaries of authorized address control and which withdrawal stages it actually protects. The nearest observable signal is an official comment from Liquid detailing the attack mechanism and amount. Significant uncertainty remains: the package lacks primary confirmation and technical details.