4,000 BTC Left Liquid Network Without Stolen Keys Exposing a Bigger Bitcoin Bridge Problem

Key Takeaways

• Nearly 4,000 BTC left Liquid's federation reserves even though Liquid said the relevant peg-out authorization key was not compromised.

• The federation's normal signing process approved the withdrawal after apparently invalid L-BTC reached an authorized peg-out service.

• The incident shows how Bitcoin bridge security depends on software validation as well as custody keys.

• The self-described white hats have since returned 3,400 BTC, while roughly 598.5 BTC remains with them.

Nearly $320 million in Bitcoin left the Liquid Network without attackers stealing the cryptographic keys protecting its federation wallet.

That detail may be more important than the size of the withdrawal.

On Sept. 6, roughly 4,000 L-BTC was submitted to SideSwap's peg-out service. The tokens passed through a valid authorization process and were burned, after which Liquid's federation released approximately 3,996 BTC to the recipient.

Liquid said the SideSwap Peg-out Authorization Key used in the transaction was not compromised.

Instead, SideSwap said Blockstream later determined that the L-BTC involved had been created through a bug in Elements, the software underlying Liquid.

That means the system appears to have authorized the release of real Bitcoin against L-BTC that should not have existed.