Every Liquid Key Held. The Federation Still Paid Out $320 Million for L-BTC That Never Existed

What Happened

At 14:06 UTC on Sunday, September 6, a peg-out transaction on Blockstream's Liquid Network asked the Liquid Federation to release roughly 4,000 BTC, about $320 million at Sunday's price near $80,000, to a fresh Bitcoin address. The federation wallet, an 11-of-15 multisig whose keys sit in hardware security modules (HSMs) run by 15 functionaries, signed it.

Before the transaction the wallet held about 4,200 BTC backing Liquid Bitcoin (L-BTC), the sidechain's pegged token. Afterward Blockstream's proof-of-reserves page showed roughly 200 BTC, a drop of about 95%. Reconstructions of the on-chain record put the outflow between 3,996 and 4,019 BTC depending on what they count.

Liquid said in a statement posted to X that the withdrawal went out through the Peg-out Authorization Key (PAK) of SideSwap, a federation member that runs a peg-out service for ordinary users, and that the key 'was not compromised, nor were any others.' SideSwap said the peg-out 'went through SideSwap's peg-out service on a customer order' and that 'the L-BTC came from an Elements bug, not from any SideSwap system.'

Elements is the open-source codebase, maintained by Blockstream, that Liquid runs on. Blockstream's account is that a bug let someone create L-BTC that should not exist, SideSwap could not tell counterfeit from real, and the functionaries released bitcoin against it because, by the chain's own rules, the transaction was valid.

Liquid disabled its bridge nodes, which stops new transactions, and notified exchanges, which paused or are pausing L-BTC deposits and withdrawals. Other Liquid-issued assets, including USDT, were reported unaffected. Hours later, the recipient address wrote 'we are whitehats. contact us on chain' into an OP_RETURN field, the slot in a Bitcoin transaction that carries arbitrary data, and sent 1,000 satoshis to the federation's own address so it would be read.

Blockstream answered on-chain with its security email. The recipient replied with a Signal handle, offered to send 'most' of the funds back, then added a condition: fix the bug first, 'make sure every node is patched,' and the money returns 'after confirming the fix.' As of Monday morning no bitcoin had moved back, and Liquid had not said when the network would reopen.

15 signers, 11 signatures, 0 stolen keys, and $320 million out the door: a federation's shared software is a single point of failure wearing 15 badges.

The Multisig Was Never the Attack Surface

Liquid's security model, as Blockstream documents it, is built against dishonest or compromised signers. Bitcoin pegged into Liquid sits in an 11-of-15 multisig; each key lives in a proprietary HSM inside a functionary unit held by a federation member. The PAK list is the backstop behind the backstop: functionaries will only sign a peg-out whose destination belongs to a registered member key, so that even an attacker holding 11 functionaries could at worst send bitcoin to a member's own cold wallet.

Ordinary users have no PAK entry; they leave Liquid by handing L-BTC to a member such as SideSwap that has one. Every one of those controls worked on Sunday. The HSMs confirmed that L-BTC had been burned, confirmed that the destination was whitelisted, and signed. What none of them could check was whether the burned L-BTC had ever been legitimately created, because all 15 functionaries run the same Elements code, and that code said it had.

That is the inversion. A threshold of 11 defends against 10 bad operators; it defends against nothing when the failure is shared by all 15, and shared software is what a federation runs on by design. In June 2020, a mismatch between the timelock parameters on the functionary HSMs and on the functionary servers left a single 870 BTC output spendable by Blockstream's 2-of-3 emergency keys for less than an hour, a condition developer James Prestwich disclosed and Blockstream patched within a week.

No key was misused then either. The tally is 2 incidents in 6 years, both software, 0 key compromises: the threat model has held, and the threat has walked around it twice. In fairness to the design, a federation can also do what Bitcoin cannot. It paused within hours, notified exchanges, and opened a channel to the counterparty.

Those are real capabilities. They are also the capabilities of a custodian, which is the point.

A White Hat Is a Claim Until the Coins Move

Ledger's chief technology officer, Charles Guillemet, put the skeptical case in a sentence: 'White hats don't drain a bridge and then solicit an on-chain contact.' He pointed to the 2022 Ronin bridge theft, more than $600 million that never came back, and to the 2023 Euler Finance exploit, where the attacker returned the funds after negotiation.

He later softened the reading: criminal groups do not usually try to contact their victims either, and there is 'hope' that this is 'people with good intentions' unfamiliar with responsible disclosure. Both readings fit the evidence; neither settles the label, and the offer to return 'most' of the funds already prices in a bounty nobody agreed to.

Until bitcoin moves back to the federation wallet or a signed agreement is public, 'white hat' is a negotiating position.

The condition attached to that offer deserves attention: patch every node first, then the money comes back. The logic is sound; this site documented why. 'Cosmos Cleared This Bug in April. The Public Fix Showed Attackers How to Drain 6 Chains' traced what happened when a fix and its exploit path went public hours before most chains could upgrade: attackers moved first.

Whoever holds Liquid's bitcoin is saying the same bug is live on every unpatched Elements node, and that a public fix now would be a public exploit. That gives Blockstream a reason to stay quiet about the root cause and gives L-BTC holders a longer wait. Meanwhile the peg's arithmetic is unforgiving.

The L-BTC that honest holders own was not what got burned; the counterfeit was. Roughly 4,200 L-BTC of legitimate claims now sit against roughly 200 BTC of reserves, and the party who decides when that changes is anonymous.

What This Means for You

Start with what L-BTC is. It is a claim on 15 machines running the same software, redeemable only through a member who holds a peg-out key, at a time the federation chooses to be open. That was true before Sunday; Sunday made it legible. If you hold L-BTC in a wallet you control, you hold the private keys to a claim, and that claim is frozen against roughly 5% reserves until the coins return or Blockstream and the federation make holders whole from somewhere else.

Self-custody of a pegged asset is self-custody of an IOU. Size it like an exchange balance: what you need for the settlement you came to Liquid for, and none of your long-term savings.

Concretely: if you hold L-BTC, do nothing rash while the chain is paused. You cannot peg out, and a panic sale into whatever thin market exists for a token on a halted network locks in a discount that may not survive the week. If your L-BTC sits on an exchange, ask in writing whether customer L-BTC balances will be honored 1-for-1 in BTC regardless of the federation's recovery.

If you run an Elements node or a product on one, treat the counterparty's claim that unpatched nodes remain exposed as credible and apply Blockstream's fix the hour it ships. Bitcoin you hold as mainchain outputs behind your own hardware wallet, single-sig or multi-sig, was untouched by all of this and cannot be paused by anyone.

That is the difference between the 2 assets that changed hands on Sunday.

Name the limit, though. Mainchain self-custody does not give you confidential amounts, 1-minute settlement, or USDT on the same rails, and those features are why Liquid exists. You rent them by accepting federation risk, and on Sunday the rent came due. The same trade sits under every wrapped bitcoin, WBTC and cbBTC included, and under every exchange balance.

The honest posture is not 'never use Liquid.' It is that the pegged layer is a hot wallet with better cryptography, and a proof-of-reserves page can show you the loss in real time without stopping it.

What to Watch

Watch the federation wallet, not the messages: bitcoin returning to it is the only fact that settles the white hat question. Watch for Blockstream's root-cause disclosure and the Elements release that carries the fix, and for whether any other Elements-based chain reports the same exposure.

Whether Liquid resumes peg-outs before or after full recovery will show how the federation weighs holder liquidity against the counterparty's demand. If the coins do not come back, the next question is whose balance sheet makes L-BTC whole: Blockstream's, the members', or nobody's.

And the exchanges that list L-BTC, Bitfinex and BTSE among them, will have to say whether customer balances stay 1-for-1; their answers will show who was carrying the peg's risk.

Tracked entities this report names, with total coverage across the archive. Follow one into the Actor Network to see every report it appears in.

Other reports that name the same tracked actors — a different thread than “related,” which follows wording. These are linked by who appears in them.