What happened
On 19 August 2021 the Japanese exchange Liquid Global detected unauthorized access to warm wallets held in its multi-party computation (MPC) custody system, which was run through its Singapore subsidiary QUOINE. Attackers moved about 69 different assets out of the exchange across Bitcoin, Ethereum, TRON and the XRP Ledger. Estimates range from about $91 million (Merkle Science's updated count and the Lazarus research tracker) to $97 million (Elliptic), including roughly 107 BTC, 11.5 million XRP, about 9 million TRX and $60 million or more in ETH and ERC-20 tokens.
Liquid moved its remaining assets to cold storage and suspended crypto deposits and withdrawals. Six days later FTX lent Liquid $120 million in debt financing. Chainalysis's 2022 Crypto Crime Report attributed the receiving addresses to a party working for North Korea (the Lazarus Group).
How it happened
- The attacker gained access to Liquid's warm wallets in its MPC custody system. How that access was obtained has not been disclosed.
- Using that access, the attacker withdrew BTC, ETH and ERC-20 tokens, TRX and XRP to their own addresses on each chain.
- To avoid freezes by token issuers, the attacker swapped about $45 million of the ERC-20 tokens for ETH on decentralized exchanges such as Uniswap and SushiSwap.
- Stolen XRP was spread across secondary addresses, and part of it was sent to a large exchange, converted to about 193 BTC and moved on to new addresses.
- Liquid moved its remaining assets to cold storage, halted crypto deposits and withdrawals, and worked with other exchanges to trace and freeze the funds.
Protocol details
Evidence
- report Report archive.is
- code liquid_global.md (lazarus-bluenoroff-research) github.com
- analysis DeFiLlama defillama.com
- analysis Liquid Exchange Hacked: $94 Million Stolen elliptic.co
- analysis Major cryptocurrency exchange hacked, almost $100 million stolen welivesecurity.com
- analysis Hack Track: Analysis of Liquid Global Security Breach merklescience.com
- analysis Recently Hacked Exchange Liquid Global Secures $120M Loan From FTX coindesk.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
