nobody stole a key
Liquid lost 4,019.4 BTC on september 6. about $320 million, out in one peg-out. the federation signed it with keys that were never compromised, and SideSwap says its peg-out key wasn't either.
the hole sat upstream. an inflation bug in Elements. someone minted over 4,000 L-BTC that didn't exist. the software checked those coins, called them valid, and the signers released real $BTC against them.
reserve page before: over 4,200 BTC. after: about 207😄
then the drainer signed a message on chain. we are whitehats. contact us on chain. Ledger's CTO said the obvious back: white hats don't drain a bridge first and ask for contact after.
i've been repeating "not your keys, not your coins" like it's a whole security model. it's half of one. a bridge coin is backed by the code that counts coins. that code can be wrong. every key stays safe the whole time.
lessons:
- the wrapper is a claim, the coin is sitting somewhere else
- ask who signs the release and what convinces them a claim is real
- do this while the bridge is still open
which wrapped or bridged thing are you still holding? name it in the comments and i'll go read what actually backs each one, then post whatever i find in one go.
like it if that saved you an afternoon, follow if you want that post, from a guy who checks nothing until it's already on fire)
#bitcoin #Liquid #exploit
Liquid lost 4,019.4 BTC on september 6. about $320 million, out in one peg-out. the federation signed it with keys that were never compromised, and SideSwap says its peg-out key wasn't either.
the hole sat upstream. an inflation bug in Elements. someone minted over 4,000 L-BTC that didn't exist. the software checked those coins, called them valid, and the signers released real $BTC against them.
reserve page before: over 4,200 BTC. after: about 207😄
then the drainer signed a message on chain. we are whitehats. contact us on chain. Ledger's CTO said the obvious back: white hats don't drain a bridge first and ask for contact after.
i've been repeating "not your keys, not your coins" like it's a whole security model. it's half of one. a bridge coin is backed by the code that counts coins. that code can be wrong. every key stays safe the whole time.
lessons:
- the wrapper is a claim, the coin is sitting somewhere else
- ask who signs the release and what convinces them a claim is real
- do this while the bridge is still open
which wrapped or bridged thing are you still holding? name it in the comments and i'll go read what actually backs each one, then post whatever i find in one go.
like it if that saved you an afternoon, follow if you want that post, from a guy who checks nothing until it's already on fire)
#bitcoin #Liquid #exploit