Liquid cryptocurency exchange loses over $90 million following hack

Japan-based cryptocurrency exchange Liquid has suspended deposits and withdrawals after attackers have compromised its warm wallets.

Liquid is one of the largest cryptocurrency-fiat exchange platforms worldwide (based on daily traded spot volume).

The exchange has more than 800,000 customers from over 100 countries and says that it reached a $1.1B+ daily trade volume this year.

After discovering that its warm wallets were hacked, the crypto exchange moved its assets into a cold wallet.

"We are currently investigating and will provide regular updates. In the meantime deposits and withdrawals will be suspended," Liquid said.

Current status of Liquid services:

• To ensure safety of funds, please do not deposit any crypto assets to your Liquid wallets until further notice.
• Liquid has halted all crypto withdrawals while we assess the impact.
• Fiat withdrawals and deposits remain available.
• Other services on Liquid, including trading and Liquid Earn, remain available.

Over $90 million worth of assets stolen

"A total of approximately 91.35mm USDe of crypto assets were moved out of Liquid wallets by an unauthorized party," Liquid said in a follow-up incident report.

"69 different crypto assets were misappropriated and sent to other exchanges or defi swapping venues. Assets placed in Liquid Earn are not impacted."

Blockchain analytics firm Elliptic added that "the stolen funds include $45 million in Ethereum tokens, which are currently being exchanged for ETH on DEXs such as Uniswap and SushiSwap" which would allow the attackers to "avoid having these assets frozen."

Liquid is still assessing the attack vector used in the incident and is "taking measures to mitigate the impact to users."

Liquid previously reported a data breach in November 2020 after GoDaddy, the exchange's domain hosting provider, transferred control of its account and domain to a malicious actor.

A subsequent security notice issued in January revealed that the threat actor breached Liquid's infrastructure and gained access to customer personal information including emails, names, addresses, encrypted passwords, and API keys.

Today's incident follows the biggest cryptocurrency hack ever, the theft of over $611 million after an unknown threat actor hacked Poly Network's cross-chain interoperability protocol last week.

In a weird twist of events, Poly Network first threatened the attacker (known as Mr. White Hat) to return the stolen cryptocurrency to avoid landing on law enforcement's radar. It then awarded him a $500,000 bounty and invited him to be the company's Chief Security Advisor. 

Since the attack took place, Mr. White Hat has gradually transferred the stolen assets to Poly Network's wallets.

In July, the FBI issued a Private Industry Notification warning cryptocurrency owners, exchanges, and third-party payment platforms of threat actors actively targeting virtual assets in attacks that can lead to significant financial losses.

Update: Story and title updated using info from Liquid's incident report.