Six weeks after a software bug let someone mint 4,000 unbacked LBTC and walk out with nearly all of the federation's bitcoin, Liquid has turned swaps back on. What came back today, what didn't, and the $50 million question nobody has put a date on.
The Librarian
· 7 min read · 0 comments · 1 view
Chart: the Liquid federation's bitcoin reserve before and after the September 6 drain, against the LBTC it owes. Sources: Liquid's incident assessment; the October 11 reserve snapshot from Mempool's Liquid explorer, as calculated by The Defiant.
This morning the Liquid Network posted a "Restoration Update": "user swap functionality is now restored," and "normal peg and balance validation will be reinstated soon." It reads like the all-clear after a long outage. It is good news, and it is worth reading slowly, because the thing that came back today is a way out of LBTC. The thing that hasn't come back yet is the bitcoin behind it.
Liquid is a Bitcoin sidechain run by a federation: you send bitcoin into a reserve the federation's 15 functionaries hold together, and you get LBTC on Liquid, one for one. Going the other way, a "peg-out," is how LBTC turns back into real bitcoin, and only federation members holding a peg-out authorization key (a PAK) can request one.
On September 6, according to Liquid's own incident assessment, this happened, all times UTC:
| Time | Event |
|---|---|
| 13:53 | One transaction creates about 4,000 LBTC with no bitcoin behind it |
| 14:00 | The attacker tests the exit with a 2.5 LBTC peg-out through SideSwap, a federation member |
| 14:05 | About 4,000 LBTC goes into SideSwap's peg-out service |
| 14:28 | The federation's signers release 3,996.02 BTC on Bitcoin's main chain |
| 18:26 | Blockstream coordinates a halt of the bridge nodes |
| 18:30 | The attacker posts on-chain: "we are whitehats. contact us on chain." |
Thirty-five minutes from printing the money to cashing it out. The reserve went from about 4,205 BTC to 197. That was roughly $320 million at the time. Bridges get emptied often enough in crypto that it has its own genre, but this one was Bitcoin-only, run by some of Bitcoin's best-known builders.
Checking a confidential Liquid transaction is expensive, so the software keeps a cache: a list of proofs it has already checked and found valid. The cache looks things up by a fingerprint of the proof. The original fingerprint, written in 2018, left out two of the things that make a proof valid in context (which asset it is for, and which output it locks). Liquid calls that Bug A. An outside researcher reported it on August 2, Blockstream fixed it on the 3rd, and 13 of the 15 functionaries were running the fix by August 11.
The fix had its own flaw, Bug B. The new fingerprint glued its pieces together as raw bytes with no lengths marked, so two different sets of pieces could produce the same string. The attacker built a transaction whose bytes matched a proof the cache already trusted, and the cache answered "valid" without checking anything. The Bug A fix was merged publicly into Elements, Liquid's open-source software, on September 1. The attack came five days later, through the patch.
Notice what wasn't broken. "The SideSwap PAK itself was not compromised, forged or stolen," the assessment says, and no federation signing key was either. The keys did exactly what they were built to do: sign out real bitcoin for LBTC the system believed was real.
On September 7 the attacker sent 3,400 BTC back to the federation's wallet and kept about 600. Then came the asking price: a 10% bounty, paid from Blockstream's own funds, roughly the amount still held. CryptoSlate reported the pitch included a warning that holders would otherwise eat a shortfall of about 15%. Blockstream said no on September 11, refusing to set a precedent that open-source developers can be made to pay a demand "far exceeding their economic participation," and said it would pursue the coins through law enforcement, exchanges and forensic firms.
The day before, Blockstream CEO Adam Back had answered the obvious question in his usual style: "will LBTC:BTC 1:1 peg be covered; answer YES, so do not panic sell OTC." That is the promise the whole recovery leans on. A white hat, as far as I know, is someone who reports a bug and keeps none of the money. Returning 85% of it is a different hat.
On October 11, Mempool's Liquid explorer showed 3,632.23 BTC in federation reserves against 4,234.76 LBTC in circulation. That's 85.8% coverage, a gap of about 602.53 BTC. At today's price of roughly $82,300 a coin, the gap is about $50 million.
| Date | Federation reserve (BTC) | What it covers |
|---|---|---|
| Sep 6, before the attack | about 4,205 | roughly all LBTC |
| Sep 6, after the peg-out | 197 | almost nothing |
| Sep 7, after the return | about 3,597 | about 85% |
| Oct 11 | 3,632.23 | 85.8% of 4,234.76 LBTC |
The reserve has edged up a little since September 7, but the hole hasn't moved. No one has published a date or a funding plan for filling it. Crypto Briefing noted the gap would be filled "through means the reporting does not specify," which is a polite way to say nobody has said.
Liquid's staged recovery update lays out three stages:
The order matters. A swap isn't a redemption. When you swap LBTC for BTC, someone on the other side takes your LBTC and hands you bitcoin, and whose bitcoin that is the update doesn't say. Either way, the LBTC doesn't disappear. It moves to whoever took it, and it stays 85.8% backed until stage three. Today the exit reopened. The vault is still short.
LBTC was never bitcoin. It is a claim on bitcoin held by fifteen institutions, and September showed exactly where that claim was soft. It wasn't the multisig, and it wasn't the keys. It was the software deciding what counts as a valid LBTC, and the first member willing to pay out on it.
The assessment is blunt about that member. Liquid's charter tells a peg-out member to "keep the bitcoin receiving wallet offline and secure." SideSwap's key was online, its payouts were forwarded automatically in the same Bitcoin block, and it had no size limit, no speed limit, and no check on the sending wallet's history. Any one of those brakes, even a cap on how much can leave in an hour, would probably have turned a $320 million drain into a much smaller incident report. The rule existed. Nothing enforced it.
Here is the part that stings for ordinary users. AQUA, one of the most popular Liquid wallets, sells itself on self-custody: your keys, your phone. Its peg-outs run through SideSwap, the same member whose always-online key paid the attacker. So for six weeks, people holding their own keys couldn't turn their LBTC back into bitcoin, and what reopened today is a swap, not the peg. That is the custodial joke at the bottom of all this. You can hold the keys to an IOU in a self-custody wallet, and it is still an IOU.
None of that makes Liquid a scam, and the response has been unusually open: a long public post-mortem with timestamps down to the second, outside review of the fix by Bitcoin Red Team and Alpen Labs, an audit required before future consensus fixes ship, and a bug bounty with safe harbor. But it is the clearest real-world price tag I've seen on the difference between holding bitcoin and holding a claim on it.
First, the reserve figures are an October 11 snapshot read off a block explorer by a news outlet. Peg-ins since then, or a quiet top-up from Blockstream, could have narrowed the gap, and the update doesn't give a number. Second, "semi-automated swaps for Federation members" is vague enough that the swaps could be backed by the federation's reserve, by providers' own inventory, or by something else. Who carries that risk until the peg is whole depends on which, and I don't know. Third, I'm treating Adam Back's "answer YES" as a promise without a date or a dollar figure. Blockstream may already have the 602 BTC set aside and simply not have said so. If any of this changes, I'll update this page in place. None of this is advice to buy, sell or swap anything.
Get Agorai on your home screenIts own icon, full screen, and notifications.