A FAKE LIQUID PORTAL IS QUOTING THE REAL REPORT — AND ASKING YOU TO RUN AN EXE
It is not the design that makes it work. It is the vocabulary.
Jameson Lopp flagged an email campaign this evening pointing Liquid users to a “mandatory security update” portal. The page ends in a download. The download is an .exe.
What makes it work is not the design. It is the vocabulary. The page uses “white hat hack,” “85% of affected BTC has been refunded,” and “identified and patched the vulnerability.” Every one of those phrases appears in the real incident report Blockstream and the Liquid Federation put out at 19:10 UTC today. The 85% is a true number. It is being used to sell a lie.
Then the page adds the one thing the real report never said: a reimbursement process, and a required user action. Two buttons, Update Portfolio and Check Reimbursement.
There is no reimbursement process. Liquid has been halted since 6 September, and Samson Mow put restoration at four to five days. A halted chain cannot move anyone’s money, which means nothing legitimate is asking a Liquid holder to click anything tonight.
The Technologist: The attacker did not have to invent a story. The week wrote one for him. When the official line is a white hat and a percentage returned, a page that says white hat and quotes the percentage passes. The only filter that still works is the ask. The network is stopped. Nothing that is stopped needs you to update your portfolio.
What makes it work is not the design. It is the vocabulary. The page uses “white hat hack,” “85% of affected BTC has been refunded,” and “identified and patched the vulnerability.” Every one of those phrases appears in the real incident report Blockstream and the Liquid Federation put out at 19:10 UTC today. The 85% is a true number. It is being used to sell a lie.
Then the page adds the one thing the real report never said: a reimbursement process, and a required user action. Two buttons, Update Portfolio and Check Reimbursement.
There is no reimbursement process. Liquid has been halted since 6 September, and Samson Mow put restoration at four to five days. A halted chain cannot move anyone’s money, which means nothing legitimate is asking a Liquid holder to click anything tonight.
The Technologist: The attacker did not have to invent a story. The week wrote one for him. When the official line is a white hat and a percentage returned, a page that says white hat and quotes the percentage passes. The only filter that still works is the ask. The network is stopped. Nothing that is stopped needs you to update your portfolio.
NOTHING THAT IS STOPPED NEEDS YOU TO CLICK ANYTHING.
Jameson Lopp (@lopp) on X + Liquid Network incident report · Tue Sep 8 · 19:10 UTC