[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fT6-36oZI9tcZjVBD2-zB9bucuKq194Pzxfj1pwGXSWY":3},{"article":4,"iocs":46,"watch_terms":50,"solutions":51,"lesson":138},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"9470e2c3-4038-4820-9dcc-9af10a24431c","Hackers Return $263 Million Stolen From Liquid Network","hackers-return-263-million-stolen-from-liquid-network-e5b4ca","Alleged ‘white-hat’ hackers drained $320 million from Liquid’s federation wallet, demanding a bug fix. The post Hackers Return $263 Million Stolen From Liquid Network appeared first on SecurityWeek.","Alleged 'white-hat' hackers stole approximately $320 million in Bitcoin from the Liquid Network's federation wallet. They have since returned 3,400 Bitcoin, valued at around $262.6 million, with the remaining ~598 Bitcoin outstanding. The hackers claim they will return the rest once Liquid resolves the vulnerability that enabled the heist.","Hackers returned $263M of $320M stolen from Liquid Network, demanding a bug fix.","https:\u002F\u002Fwww.securityweek.com\u002Fhackers-return-263-million-stolen-from-liquid-network\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2024\u002F08\u002Ftakedown-law-enforcement.jpeg","2026-09-08T16:35:54+00:00","2026-09-08T18:00:08.215636+00:00",7,[17,20],{"name":18,"type":19},"Liquid Network","product",{"name":21,"type":22},"Blockstream","vendor","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":23,"icon":25,"name":26,"slug":27},null,"Breaches","breaches",[29,34,36,41],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"0493c7e9-989a-4692-b4e6-136f5ec09675","Cryptography","cryptography",{"category":35},{"id":23,"icon":25,"name":26,"slug":27},{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":42},{"id":43,"icon":25,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[47],{"type":40,"value":48,"context":49},"SideSwap PAK","The funds were withdrawn via the SideSwap PAK (Peg-out Authorization Key), which was reportedly not compromised.",[21,18],{"controls":52,"vendors":137},[53,79,108],{"slug":54,"name":55,"problem":56,"products":57},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[58,66,74],{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","luna-hsm","Thales Luna HSM","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fhardware-security-modules","Hardware security modules for protecting cryptographic keys.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"utimaco","Utimaco","\u002Fvendor-logos\u002Futimaco.png","utimaco-hsm","Utimaco General Purpose HSM","https:\u002F\u002Futimaco.com\u002Fdata-protection\u002Fgp-hsm","Hardware security modules for key generation, storage and cryptographic operations.",{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":75,"product_name":76,"url":77,"description":78},"ciphertrust","CipherTrust Data Security Platform","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fdata-security-platform","Data discovery, encryption and central key management across on-premises and cloud.",{"slug":80,"name":81,"problem":82,"products":83},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",[84,92,100],{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"commvault","Commvault","\u002Fvendor-logos\u002Fcommvault.png","commvault-cloud","Commvault Cloud","https:\u002F\u002Fwww.commvault.com\u002Fplatform","Backup and recovery platform with immutable storage and recovery testing.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"rubrik","Rubrik","\u002Fvendor-logos\u002Frubrik.png","zero-trust-data-protection","Rubrik Zero Trust Data Protection","https:\u002F\u002Fwww.rubrik.com\u002Fproducts\u002Fdata-protection","Air-gapped, immutable backup for on-premises, cloud and SaaS data, with threat detection in backups and orchestrated recovery.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"veeam","Veeam","\u002Fvendor-logos\u002Fveeam.png","veeam-data-platform","Veeam Data Platform","https:\u002F\u002Fwww.veeam.com\u002Fproducts\u002Fveeam-data-platform.html","Backup and recovery for virtual, physical, cloud and SaaS workloads, with immutable storage options.",{"slug":109,"name":110,"problem":111,"products":112},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",[113,121,129],{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"truesec","Truesec","\u002Fvendor-logos\u002Ftruesec.png","truesec-incident-response","Truesec Incident Response","https:\u002F\u002Fwww.truesec.com\u002Fservice\u002Fincident-response","Incident response team with a retainer option.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","incident-response","CrowdStrike Incident Response","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fservices\u002Fincident-response\u002F","Incident response services, available on retainer.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","mandiant-incident-response","Mandiant Incident Response","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fconsulting\u002Fmandiant-incident-response-services","Incident response services from Mandiant, available on retainer.",[],{"slug":139,"title":140,"body":141,"framework_refs":142,"framework_notes":152},"liquid-network-loses-320m-to-federation-wallet-exploit","Liquid Network Loses $320M to Federation Wallet Exploit","Attackers exploited an unpatched vulnerability in Liquid Network's federation wallet, a multi-signature custodial system designed to secure large volumes of Bitcoin — underscoring that even purpose-built security architectures can harbor critical flaws. The partial return of funds by self-described 'white-hat' hackers does not diminish the severity of the incident; organizations should never rely on an attacker's goodwill to recover assets. The fact that the hackers are conditioning the return of remaining funds on Liquid resolving the vulnerability highlights a dangerous dynamic where attackers dictate security remediation timelines. This case illustrates that high-value cryptocurrency custodial systems require continuous, proactive vulnerability assessments rather than reactive patching after a breach.",[143,144,145,146,147,148,149,150,151],"CIS Control 7 – Continuous Vulnerability Management","CIS Control 6 – Access Control Management","CIS Control 8 – Audit Log Management","NIST CSF ID.RA-1 – Asset Vulnerability Identification","NIST CSF PR.AC-4 – Access Permissions and Authorizations","NIST SP 800-115 – Technical Guide to Information Security Testing","NIST CSF RS.RP-1 – Incident Response Plan Execution","ISO\u002FIEC 27001 A.12.6 – Technical Vulnerability Management","ISO\u002FIEC 27001 A.9.4 – System and Application Access Control",{}]