0xfrigg

On September 6 exactly 3,996.01834922 $BTC left the Liquid Federation reserve.
Naturally the first headlines made this sound like some kind of Bitcoin hack.
It wasnt.
Bitcoin L1 was not compromised.
According to SideSwap’s official statement, the attacker first created L-BTC on Liquid through a bug in the Elements software and then passed that L-BTC through what looked like a normal peg-out process.
The federation saw the peg-out as valid and paid out real BTC on Bitcoin mainnet.
https://x.com/liquid_btc/status/2096696272447218108
So someone didnt hack Bitcoin directly.
The software behind Bitcoin’s federated sidechain allowed invalid L-BTC to look like real L-BTC.
And because the federation believed those assets had been legitimately burned, it released real BTC from its reserve.
That difference is basically the whole story.
Bitcoin’s blocks, miners, consensus, cryptography and normal L1 wallets were not compromised.
What was affected was Liquid.
L-BTC, the peg infrastructure and the ability to move assets through the network were the actual problem.
What we know and what we still dont
What we know:
➛ Around 4,000 BTC left the Liquid Federation reserve
➛ “Bitcoin mainnet was hacked” is false
➛ SideSwap says its PAK key and infrastructure were not stolen
https://x.com/side_swap/status/2096709838310928674
➛ The issue came from a bug in Elements
➛ Liquid operations were stopped
What we still dont know:
➛ Whether all funds will be returned
➛ The exact total amount of unbacked L-BTC created
And I think keeping those two groups separate matters here.
There is already a lot of speculation around the exact bug. But until we get a proper technical post-mortem, some of those details are still only theories.
First, what is Liquid?
Lets make the setup simple first.
Bitcoin is extremely secure, but Bitcoin itself is not designed to do every financial thing people want to do with BTC.
Liquid is a separate network running alongside Bitcoin.
A sidechain.
Unlike Ethereum or other open validator networks though, Liquid is managed by a group of institutional participants called the Liquid Federation.
The basic user flow looks like this:
You send BTC into Liquid. That BTC gets locked in the federation’s Bitcoin mainnet reserve.You receive L-BTC on Liquid.You can use that L-BTC inside Liquid for faster transfers, confidential transactions or other products.When you want BTC back, the L-BTC is burned and the federation releases BTC from its reserve on Bitcoin mainnet.
Liquid protects that BTC reserve using an 11-of-15 multisig.
At least 11 of the 15 functionaries have to sign before BTC can leave the reserve.

Sounds pretty strong.
And for key security it is.
But this incident shows why key security alone is not enough.
You dont need to steal 11 keys if all 11 honest signers are being shown the same wrong information.
If the software tells everyone “this withdrawal is valid”, honest signatures can still approve a bad payment.
That is much more interesting to me than simply saying “multisig failed.”
So what actually happened?
1. A bug in Elements made invalid L-BTC look valid
Liquid runs on open-source software called Elements.
Elements adds things like confidential transactions, confidential assets and the federated two-way peg on top of Bitcoin-like infrastructure.
SideSwap’s statement is pretty clear on this part:
The L-BTC used in the peg-out had been created because of a bug in Elements software.
In other words the attacker had L-BTC that shouldnt have existed.
This wasnt a stolen-wallet-password situation.
It was a validation problem.
The network accepted something as valid that shouldnt have been valid.
The exact technical mechanism of the bug still has not been published in a full official post-mortem.
There are claims around things like rangeproof caching and confidential transaction components, but I wouldnt treat any of those as confirmed until Blockstream or Liquid publishes the technical breakdown.
2. The attacker sent 4,000 L-BTC into SideSwap’s peg-out
According to SideSwap:
September 6, 14:05 UTC
A customer sent 4,000 L-BTC to SideSwap’s peg-out service.
From the system’s perspective it looked like a normal request.
The L-BTC was burned.
The peg-out authorization looked valid.
PAK, or Peg-out Authorization Key, is basically another control that limits which Bitcoin addresses can receive peg-outs.
And this is another important point:
The PAK key was not stolen.
Liquid and SideSwap both said that the PAK and other signing keys were not compromised.
So again, the problem was not somebody stealing the keys and forcing the system to send BTC.
The system itself believed the withdrawal was legitimate.
3. Real BTC then left the federation reserve
At 14:28 UTC, the Liquid Federation paid exactly:
on Bitcoin mainnet.
You can verify the Bitcoin transaction here: https://mempool.space/tx/8db751a650ae2f12006b7e8c69a75e4df360e8afd6b9e05ae0b9fa6458a7b140
And the related Liquid peg-out here : https://blockstream.info/liquid/tx/ce4caece413cd9d444ce7ed9f54e5b328b3da5e4af301aff59a3571f76e988f2
So when people say “4,000 BTC” they are rounding.
The verifiable Bitcoin payment was 3,996.01834922 BTC, worth around $318–320M at the time.
This is real BTC that left the federation reserve.
That part isnt theoretical.
4. Liquid stopped
After the incident Liquid disabled bridge nodes and stopped new transactions.
Exchanges also started suspending L-BTC deposits and withdrawals.
So this wasnt only a reserve accounting problem.
If you were actually using Liquid, your ability to transfer, swap, peg in or peg out was affected too.
5. The attacker says they are whitehats
There is also this part.
The attacker left a message on Bitcoin:
“we are whitehats. contact us on chain.”
But saying you are a whitehat does not make you one.
At least not yet.
Until the funds are actually returned, the vulnerability is responsibly disclosed and the damage is resolved, I think the safest description is simply this:
The attacker claims to be a whitehat.
The funds have not been confirmed as returned.
So for now this is still an unresolved, very large security incident.
Why wasnt Bitcoin hacked?
Because from Bitcoin’s point of view nothing invalid happened.
The transaction had the required signatures.
Miners saw a valid Bitcoin transaction.
Bitcoin consensus accepted it.
No one broke Proof-of-Work.
No one broke Bitcoin cryptography.
No one changed the 21M supply cap.
Bitcoin had no way to know that the accounting inside Liquid was wrong.
Think of it like a bank.
Imagine a bank has a vault where withdrawals require multiple authorized signatures.
The bank’s internal system mistakenly tells those signers that a customer really owns $100M.
They approve the transfer.
The vault itself didnt fail.
The authorization process received bad information.
That is basically the distinction here.
So:
“Bitcoin was hacked” is wrong.
“Liquid’s federated peg suffered a major security failure” is much closer to what actually happened.
And this is where the story gets more interesting
For me the bigger lesson isnt really Liquid specifically.
Its what happens every time we take BTC and make it more usable somewhere else.
Native BTC in your own wallet mainly depends on Bitcoin’s own security assumptions.
L-BTC depends on more things.
Bitcoin consensus + Liquid software
Proof-of-Work + federation trust
Your keys + the peg mechanism
Liquid’s asset validation
And the federation managing the BTC reserve correctly.
That doesnt automatically mean L-BTC is unsafe.
It just means the risk model is wider.
Every bridge, sidechain, wrapped BTC product or custodian adds something useful.
And usually it also adds another thing that has to work correctly.
11-of-15 sounds safe. But what are the 11 actually signing?
This is probably my favorite part of the incident.
When people think about multisig security the question is usually:
How many keys would an attacker need to steal?
11-of-15 sounds strong because stealing 11 independent signing keys is obviously difficult.
But according to the current official explanation, that didnt happen here.
The signers were apparently presented with a state that looked valid.
So maybe the more important question is:
What are those 11 signers actually verifying?
And do all 11 depend on the same software logic?
Because if every signer independently has a secure key but every signer trusts the same broken validation logic, then key diversity does not necessarily give you validation diversity.
That is a very different type of risk.
And its one people talk about much less.
Even proof of reserves gets more complicated
Normally the obvious question for something like L-BTC is:
Does the amount of BTC sitting in the reserve match the amount of L-BTC in circulation?
Makes sense.
But confidential transaction systems make this harder because token amounts may not always be publicly visible in the same simple way.
And there is another issue.
If invalid L-BTC can be created and then burned in the same process that withdraws real BTC, a basic snapshot taken later may not tell you the whole historical story.
You could potentially look at the system after the event and miss how the mismatch happened.
I dont want to go further than the evidence here though.
This is not a final judgment on Liquid’s reserve design.
It is a reconciliation problem exposed by the incident.
We need the full technical report, reserve reconciliation and complete mint/burn accounting before making stronger claims.
Is this systemic for Bitcoin?
I dont think so.
Roughly 4,000 BTC is huge money.
But relative to Bitcoin itself it is not a systemic supply shock.
Bitcoin protocol security was not affected either.
So I wouldnt turn this into a “Bitcoin is broken” market story.
But for the infrastructure being built around Bitcoin?
Yes, this matters.
Especially as BTC gets wrapped, bridged, custodied and financialized across more systems.
There is also another distinction around other Liquid assets.
Liquid said assets like USDT, DePix and RWAs were not directly compromised by the security incident.
But “not directly compromised” does not mean “completely unaffected.”
If the network is stopped, you can still have transfer and liquidity problems even if the token itself was not hacked.
So who actually needs to care?
If you hold native BTC in your own wallet
This incident does not directly affect your protocol security.
Bitcoin L1 was not compromised.
If you hold L-BTC
You have operational exposure to Liquid’s peg, transfers and network restart.
Peg-outs, swaps and transfers being stopped obviously matter.
If you hold USDT or tokenized assets on Liquid
There is no confirmation that those assets themselves were hacked.
But if Liquid is not operating normally, access and liquidity can still become a problem.
If you use a product built on Liquid
Then I would care about exactly how much that product depends on Liquid, what collateral it uses and what the recovery/restart plan looks like.
My take
This was not a Bitcoin hack.
And I think describing it that way actually hides the more useful lesson.
A software bug in Elements allowed unbacked L-BTC to pass through what looked like a legitimate peg-out flow.
Liquid Federation then paid out 3,996 BTC on Bitcoin mainnet.
The keys apparently werent stolen.
The signatures worked.
Bitcoin worked.
The problem was that the thing being signed looked valid when it shouldnt have.
And that changes the security question quite a bit.
Its not only:
how many keys protect the reserve?
Its also:
what information are those keys trusting before they sign?
Bitcoin can be extremely secure while something built around Bitcoin still fails.
Every time we wrap BTC, bridge it, custody it or move it into another execution environment, we get more usability.
But we also add another trust assumption.
That is the real story here

Blackrock bitcoin egasiga o‘sha bitcoinni avval sotib, uni dollarga aylantirmasdan turib, btc evaziga IBIT ETF aksiyalarini olish imkonini beradi.
Ushbu tranzaksiyada odam endi btc’ni to‘g‘ridan-to‘g‘ri hamyonida ushlab turmaydi. Buning o‘rniga ular aynan shu bitcoin ekspozitsiyasini ifodalashga mo‘ljallangan ommaviy savdoda bo‘ladigan IBIT aksiyalarini ushlab turadi.
Endi bu yerda juda muhim farq bor
Bu yangi pul bitcoin’ga kirganini yoki bozordan yangi $BTC sotib olinayotganini anglatmaydi.
Agar siz buni ajrata olsangiz, bu rivojlanishlarni ancha yaxshi tushunasiz.