Key Takeaways
- Nearly 4,000 BTC left Liquid’s federation reserves even though Liquid said the relevant peg-out authorization key was not compromised.
- The federation’s normal signing process approved the withdrawal after apparently invalid L-BTC reached an authorized peg-out service.
- The incident shows how Bitcoin bridge security depends on software validation as well as custody keys.
- The self-described white hats have since returned 3,400 BTC, while roughly 598.5 BTC remains with them.
Nearly $320 million in Bitcoin left the Liquid Network without attackers stealing the cryptographic keys protecting its federation wallet.
That detail may be more important than the size of the withdrawal.
On Sept. 6, roughly 4,000 L-BTC was submitted to SideSwap’s peg-out service. The tokens passed through a valid authorization process and were burned, after which Liquid’s federation released approximately 3,996 BTC to the recipient.
Liquid said the SideSwap Peg-out Authorization Key used in the transaction was not compromised.
Instead, SideSwap said Blockstream later determined that the L-BTC involved had been created through a bug in Elements, the software underlying Liquid.
That means the system appears to have authorized the release of real Bitcoin against L-BTC that should not have existed.
Liquid’s Keys Worked as Designed
Liquid does not rely on a single custodian to control its Bitcoin reserves.
Its federation uses a multisignature system in which 11 of 15 functionaries can authorize Bitcoin movements. Onchain analysis of the incident found that the withdrawal carried the required 11 valid signatures.
In other words, the attackers did not need to steal enough private keys to overpower the federation.
The signing infrastructure appears to have processed what it believed was a legitimate peg-out.
That exposes a different bridge risk: secure private keys cannot protect reserves if the software feeding transactions into the signing process incorrectly determines that a withdrawal is valid.
Liquid’s model depends on L-BTC remaining backed 1:1 by Bitcoin held by the federation.
If unbacked L-BTC can reach a legitimate redemption route, the problem moves upstream of key custody.
$270 Million Returned After Blockstream Patch
The incident has since taken an unusual turn.
The actors identified themselves through an onchain message as “whitehats” and told Blockstream they would return most of the Bitcoin once the vulnerability was fixed.
Blockstream later sent a PGP-signed message stating that its bridge nodes had been patched and that the funds could safely be returned.
The actors subsequently transferred 3,400 BTC, worth roughly $270 million, back to the federation.
Around 598.5 BTC, worth approximately $47 million, remains in their wallet. No publicly disclosed agreement has established that amount as an authorized bounty.
Liquid has been preparing for a coordinated restart after pausing activity and asking exchanges to suspend L-BTC deposits and withdrawals.
Bitcoin Wasn’t Broken, but the Bridge Assumption Was
The incident did not compromise the Bitcoin network itself.
Instead, it highlights the additional trust assumptions introduced when BTC moves onto sidechains and bridges.
Bitcoin’s base layer can remain secure while Bitcoin represented elsewhere becomes vulnerable to bugs in validation logic, federation software, or redemption infrastructure.
Liquid recovered most of the funds because the actors chose to return them.
The more uncomfortable question is what would have happened if they had not.
Top Trending Crypto Articles
The information provided in this article is for informational purposes only. It is not intended to be, nor should it be construed as, financial advice. We do not make any warranties regarding the completeness, reliability, or accuracy of this information. All investments involve risk, and past performance does not guarantee future results. We recommend consulting a financial advisor before making any investment decisions.
Dr. Guneet Kaur is a senior editor at CCN.com and a Science Fellow at Exponential Science. She is a fintech and blockchain expert with extensive experience in digital finance education, blockchain ecosystems, and cryptocurrency markets. She has worked with global media such as Cointelegraph, as well as education and blockchain platforms, to design and lead strategic content and learning initiatives. As an educator and assessor for top-tier executive programs, she bridges real-world fintech trends with academic insight.
Dr. Kaur is also a published researcher and peer reviewer across fintech and data science journals, including Financial Innovation Journal and International Journal of Big Data Intelligence and Applications. Her work spans data-driven analysis, Web3 innovation, and technical content development. With a strong foundation in both industry and academia, she translates complex financial technologies into practical applications, empowering learners, professionals, and institutions across the rapidly evolving digital finance landscape.
