[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fg2aLv8ncTI4b7sm3bJ_EKAq8XRAjqN90107dl9jjnlk":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":21,"status":22,"created_at":23,"published_at":24,"article":25,"tags":29,"podcasts":48,"controls":49},"4e3de19a-d9d0-4902-a45c-8aee3c809cb2","liquid-network-loses-320m-to-federation-wallet-exploit","9470e2c3-4038-4820-9dcc-9af10a24431c","Liquid Network Loses $320M to Federation Wallet Exploit","Attackers exploited an unpatched vulnerability in Liquid Network's federation wallet, a multi-signature custodial system designed to secure large volumes of Bitcoin — underscoring that even purpose-built security architectures can harbor critical flaws. The partial return of funds by self-described 'white-hat' hackers does not diminish the severity of the incident; organizations should never rely on an attacker's goodwill to recover assets. The fact that the hackers are conditioning the return of remaining funds on Liquid resolving the vulnerability highlights a dangerous dynamic where attackers dictate security remediation timelines. This case illustrates that high-value cryptocurrency custodial systems require continuous, proactive vulnerability assessments rather than reactive patching after a breach.","**Immediate actions:**\n- Conduct an emergency security audit of all federation wallet nodes and multi-signature key management processes to identify and patch the exploited vulnerability.\n- Temporarily restrict withdrawal thresholds and require additional manual authorization steps for large transactions until the vulnerability is fully remediated.\n\n**Long-term improvements:**\n- Implement a formal, recurring penetration testing program specifically targeting custodial wallet infrastructure and cryptographic signing mechanisms.\n- Enforce strict privilege separation and hardware security module (HSM) usage for all private key operations within the federation.\n- Establish a bug bounty program to incentivize responsible disclosure of vulnerabilities before malicious actors can exploit them.\n\n**Detection measures:**\n- Deploy real-time transaction anomaly detection to flag unusual withdrawal patterns or large transfers that deviate from established baselines.\n- Maintain comprehensive audit logs for all federation wallet signing events and review them through a centralized SIEM with automated alerting.",[12,13,14,15,16,17,18,19,20],"CIS Control 7 – Continuous Vulnerability Management","CIS Control 6 – Access Control Management","CIS Control 8 – Audit Log Management","NIST CSF ID.RA-1 – Asset Vulnerability Identification","NIST CSF PR.AC-4 – Access Permissions and Authorizations","NIST SP 800-115 – Technical Guide to Information Security Testing","NIST CSF RS.RP-1 – Incident Response Plan Execution","ISO\u002FIEC 27001 A.12.6 – Technical Vulnerability Management","ISO\u002FIEC 27001 A.9.4 – System and Application Access Control",{},"published","2026-09-08T18:21:19.950001+00:00","2026-09-08T18:21:19.842+00:00",{"id":7,"url":26,"slug":27,"title":28},"https:\u002F\u002Fwww.securityweek.com\u002Fhackers-return-263-million-stolen-from-liquid-network\u002F","hackers-return-263-million-stolen-from-liquid-network-e5b4ca","Hackers Return $263 Million Stolen From Liquid Network",[30,36,42],{"id":31,"name":32,"slug":33,"description":34,"color":35},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":37,"name":38,"slug":39,"description":40,"color":41},"182e11d5-57c4-444e-8ec8-4682ad60261b","Incident Response","incident-response","Slow detection, poor containment, missing playbooks","#14b8a6",{"id":43,"name":44,"slug":45,"description":46,"color":47},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",[],[50,54,58],{"slug":51,"name":52,"problem":53},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",{"slug":55,"name":56,"problem":57},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",{"slug":59,"name":60,"problem":61},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it."]