$320 million worth of Bitcoin has been stolen from the Liquid Network. What does this mean for investors?

Bitcoin and Liquid: two networks, two levels of risk

To understand where the breach occurred, it is important to distinguish between Bitcoin and the Liquid Network. Bitcoin is the main network on which cryptocurrency transfers are recorded. Liquid is a separate network, comparable to a side lane: users temporarily move their bitcoins there to carry out faster transactions and access additional features.

Liquid was developed by Blockstream, a technology company founded in 2014 by a group of cryptography and Bitcoin specialists, and went live in September 2018 with the initial participation of 23 industry operators. The project is aimed primarily at exchanges and financial intermediaries: a transaction on Liquid typically achieves final confirmation in around two minutes (compared with around 10 on the Bitcoin network), and the system also offers greater privacy for transactions.

Liquid also enables the tokenisation of assets — creating digital representations of currencies or financial instruments and transferring them over the network — with the aim of building, on top of Bitcoin, a market capable of hosting stablecoins and securities. The central mechanism is Liquid Bitcoin, abbreviated to L-BTC: anyone wishing to use Liquid deposits bitcoin into a reserve controlled by the network operators and receives, in return, the same number of L-BTC, digital tokens representing the bitcoin held in custody. The intended ratio is one-to-one — depositing ten bitcoins yields ten L-BTC — and L-BTCs are not new bitcoins: they do not increase the total amount of BTC in circulation, but function as digital receipts. When the user decides to return to the main network, they hand back the L-BTC and receive the bitcoins held in the reserve in return.

It is precisely this reserve that has been targeted: nearly 4,000 of the approximately 4,200 bitcoins deposited were transferred to an address controlled by the perpetrators of the attack. Liquid has suspended the network and exchanges have blocked L-BTC deposits and withdrawals. The vulnerability has not yet been publicly explained; Liquid has stated that the funds were withdrawn via the standard procedure for converting L-BTC back into bitcoins, and that the key used to authorise such transactions does not appear to have been compromised.

The Bitcoin blockchain, meanwhile, has continued to operate as normal: no flaws have been discovered in its cryptography, no one has altered the transactions already recorded, and the 4,000 BTC were transferred in accordance with the network’s standard rules, after being withdrawn from Liquid’s custody system.

The difference can be compared to that between the euro and a bank that holds it in custody. An attack on the bank’s systems may allow money to be stolen, but the euro continues to function and other banks are not automatically compromised. In the case of Liquid, the weak point appears to lie in the mechanism used to store bitcoins and authorise their return: the security of the main network does not automatically extend to all the infrastructure built on top of it.

The immediate consequences – and the wider implications

The most immediate consequences affect L-BTC holders: each token promises the return of one bitcoin, and if the funds were not to be returned to the reserve, a large part of that promise would remain unsecured. But the wider consequence concerns confidence in Liquid itself. The network positions itself as an infrastructure for transfers between operators and for the issuance of tokenised assets: the removal of 95 per cent of the reserves puts pressure on its security model and risks slowing down its adoption.

The affair took on a particular dimension after the perpetrators’ first message. Blockstream agreed to communicate via the blockchain and replied by sending a very small amount of bitcoin along with a text message. Subsequent communications are encrypted — the message is recorded publicly but can only be read by the recipient — whilst every step remains visible: anyone can observe the progress of the negotiations and the addresses involved in real time.

Why the price hasn’t moved

The price of Bitcoin reacted with a modest fall of around 1 per cent, remaining at around $79,500 — a limited movement given the $320 million involved in the attack. This resilience can be explained, first and foremost, by the separation between Bitcoin and Liquid: investors appear to have interpreted the incident as a breach of an external infrastructure, whilst the operation of the main blockchain and the maximum supply of bitcoins stipulated by the protocol (21 million) remain unchanged.

The destination of the funds is also significant. The nearly 4,000 BTC are concentrated in addresses controlled by the perpetrators and have not been deposited on exchanges: consequently, no direct pressure has arisen from their sale. Furthermore, the on-chain conversation has raised the possibility of a return: the request to fix the vulnerability lends some credibility to the white hats’ hypothesis, and the prospect that a large portion of the funds may be returned to the federation alleviates fears of an immediate sell-off.

In absolute terms, the 4,000 bitcoins represent a very large figure, but their share remains limited compared with the overall size of the investment class: with a market capitalisation of over 1,500 billion dollars, the 320 million in question account for around 0.02 per cent of the market.

What remains, beyond the accident

The market’s muted reaction does not eliminate the risks posed by the incident: rather, it suggests that investors are learning to distinguish between Bitcoin and the infrastructure built around it. Ultimately, the incident highlights the cost of complexity: every new layer adds functionality and creates new points that need protecting. A network may have solid foundations yet still harbour vulnerabilities in the systems built upon them.

Finally, there remains an issue relating to artificial intelligence. New models can analyse vast amounts of code and speed up the process of finding errors: they can help developers fix a vulnerability, but also enable attackers to identify it more quickly. There is no public evidence that an artificial intelligence model was used in the Liquid case, but the capabilities these systems have achieved make it plausible that the speed of cyber-attacks in general will increase.

Bitcoin represents a honeypot — a particularly attractive target, because a vulnerability can yield an immediate financial gain — and the same analytical capabilities can be turned against the systems of companies or public authorities, where the value lies in the data or in the ability to disrupt a service, and the reward may come in the form of a ransom or espionage.