Galaxy’s Alex Thorn Says Liquid’s Approved-Address Rule Didn’t Stop the Bitcoin Thieves

Liquid limits bitcoin withdrawals to addresses tied to registered authorization keys, so nobody can redirect funds to an attacker. Galaxy’s Alex Thorn says on Uneasy Money that the rule never bound the people who took roughly 4,000 BTC.

Alex Thorn: Liquid's approved-address rule didn't stop the thieves

Posted September 10, 2026 at 8:57 am EST.

Liquid is a Bitcoin sidechain run by a federation of exchanges and companies that hold real bitcoin in a shared wallet, backing the L-BTC token that circulates on the network. On Sept. 6, according to an analysis by security firm CertiK, someone exploited a bug in Liquid’s software to create roughly 4,000 L-BTC that no bitcoin backed, then converted them into real bitcoin through the network’s own withdrawal system. The withdrawal took about 95% of the bitcoin pegged into Liquid, Unchained reported, and the sidechain was frozen the same day. Liquid said the parties responsible describe themselves as white-hat hackers.

Liquid does not let just anyone move bitcoin off the sidechain. Getting out means handing back L-BTC so the federation releases the matching bitcoin on the Bitcoin network, a swap Liquid calls a peg-out, and the network’s developer documentation says it requires a Peg-out Authorization Key: “Only users with registered PAK entries can peg out.” The stated purpose is to ensure that even if federation operators were compromised, “they couldn’t redirect user funds to attacker controlled addresses.”