Liquid's 4,000 BTC Hack: Why Wrapped Bitcoin Isn't Bitcoin
At 14:28 UTC on Sunday, September 6, the Liquid Network's federation signed a peg-out transaction that paid 3,996 BTC to a wallet it had never seen before. Eleven of its fifteen keys signed, exactly as designed. Nothing was forced, no key was stolen, and the fee to move roughly $320 million was about $27. Four hours later the recipient wrote a note into a Bitcoin block: "we are whitehats. contact us on chain." By Sunday night the sidechain's reserve wallet had gone from 4,205 BTC to about 202, and every L-BTC in circulation was backed by less than five cents of actual bitcoin.
What Liquid is, and why the peg matters
Liquid is a sidechain built by Blockstream, the company co-founded by Adam Back. You lock bitcoin into a multisig on the main chain (a peg-in), and the same amount of L-BTC appears on Liquid, where blocks arrive every minute and amounts are hidden by confidential transactions. Exchanges settle on it, Tether issues USDT on it, and wallets like Aqua use it for fast, cheap transfers. When you want out, you peg out and the federation releases your bitcoin.
The federation is 15 known companies running signing servers. Any 11 can move the reserve. The entire promise rests on one sentence: there is never more L-BTC than there is bitcoin in the peg wallet. On Saturday that was true. On Sunday it wasn't.
How 2 BTC became 3,996 BTC
The attacker's wallet started with about 2 BTC of its own, pegged in on Friday. Over the next day it ran 92 small transactions on Liquid, most costing 41 sats. Sixty-eight of them shared something no normal wallet produces: an identical 4,166-byte range proof, planted over 14 hours into blocks across the network.
Range proofs are what make confidential transactions safe. A hidden amount is fine as long as a proof shows it isn't negative, because a negative output is how you print money. Nodes cache proofs they've already verified so they don't repeat the work. The on-chain record suggests the attacker was seeding every node's cache with one specific proof, then exploiting how that cache was keyed. Elements, the open-source software Liquid runs on, has a commit merged September 2 titled "fix: range proof cache bind to asset and scriptpubkey." It had not shipped in any release when the mint happened on September 6.
After three small dry-run peg-outs through SideSwap (a federation member that runs a peg-out desk), the attacker minted about 4,000 L-BTC in Liquid block 4,050,336, sent it to SideSwap, and SideSwap requested a peg-out under its own whitelisted key. The federation's signing servers saw a valid request and paid it in Bitcoin block 965,783. SideSwap took its 0.1 percent fee and forwarded the rest in the same block.
Bitcoin itself did nothing wrong here. The base chain executed a correctly signed 11-of-15 multisig spend. The bug lived one layer up, in a sidechain's consensus code.
The negotiation happened in OP_RETURN
Most attackers who want to talk open a Telegram account. This one wrote into Bitcoin, and Blockstream answered there too. Every message was a transaction paying 1,000 sats to the other side with the text in an OP_RETURN field. Blockstream's replies were PGP-signed with its published security key, which is how observers told them apart from at least two fake "send the coins here instead" messages from unrelated wallets trying to hijack the return.
The attacker's demand was specific: "Please fix the bug first. The chain is under risk at latest commit right now. Make sure every node is patched." On Monday morning Blockstream signed a message saying bridge nodes were patched. At 16:09 UTC Monday, in block 965,950, the wallet sent 3,400 BTC back to the peg wallet and kept 598.5 BTC, worth about $47 million. The last plain-text message from the attacker was a sad face.
Whether the 598.5 BTC is a bounty Blockstream agreed to or an extortion payment is not something either side has said publicly. Ledger CTO Charles Guillemet leaned toward the latter, noting that draining a bridge and then soliciting contact is not how responsible disclosure works. As of Tuesday, Liquid had not produced a block since 04:49 UTC Monday, peg-outs remained suspended, and each honest L-BTC was backed by roughly 86 cents of bitcoin.
The uncomfortable details
A few things made this worse than a clean bug story. Mempool.space, itself a federation member, flagged the unauthorized withdrawal in real time and rejected the Liquid block containing the peg-out; Blockstream's own dashboard did not reflect the loss for hours. Casa's Jameson Lopp pointed out that the public repository for the federation's signing software had not received a commit since April 2024. And the emergency recovery path, 2 of 3 backup keys plus a 56-day wait, was never needed. A regular peg-out with enough signatures worked fine.
What this means for your stack
The lesson is older than Liquid. Any bitcoin that lives somewhere other than the Bitcoin blockchain, under keys other than yours, is an IOU. L-BTC, WBTC, cbBTC, exchange balances, ETF shares: each is a claim on bitcoin held by someone else, secured by that someone's code and discipline. A federation is more decentralized than a single custodian and less decentralized than Bitcoin, and this week showed what that middle ground is worth when the code has a hole.
Practical steps:
- Keep long-term savings on the main chain in your own keys. A hardware wallet and a seed phrase you control are not exposed to sidechain consensus bugs. Nobody can mint your coins out of nothing.
- Treat sidechains and Lightning as spending money. If you use Liquid for fast settlement or Aqua for daily payments, keep only what you'd carry in a wallet, not what you'd keep in a safe.
- Verify with an independent explorer. Mempool.space's Liquid dashboard caught this before Blockstream's did. If a custodian publishes proof of reserves, check it against someone else's view.
- If you hold L-BTC right now, wait. Peg-outs are suspended and there's a 14 percent hole in the reserve. Don't panic-sell on a secondary market without doing the math on the haircut.
Liquid is useful for the exchanges that settle on it, and it will probably come back. But "not your keys, not your coins" was never just about exchanges. It's about every layer between you and the base chain. This week one of those layers had a cache that could be tricked, and 4,000 BTC walked out the front door with every signature intact.
If you've read this far, you already understand why base-layer self-custody matters. BitCloset makes heavyweight apparel for people who chose Bitcoin and hold their own keys.