No keys were stolen. Eleven of 15 signers released $320 million anyway.

Start with the exhibit, because it is the hard fact and it reads like a contradiction. On September 6, roughly 4,000 bitcoin — worth about $320 million — left the federation wallet that backs Liquid's L-BTC token, and Blockstream says no private key was compromised. The wallet had held about 4,200 bitcoin; the drain removed roughly 95 percent of it in a single transaction, leaving a few hundred coins behind. If the keys were safe, the obvious crime story dies. What actually fails is something more interesting, and more relevant to anyone who holds a wrapped or bridged "one bitcoin" that is supposed to equal one real bitcoin.

The keys did not fail. The check did.

Liquid is a Bitcoin sidechain run by Blockstream, and L-BTC is its wrapped token: users deposit bitcoin into a federation wallet, and in exchange the network credits them with L-BTC that is supposed to be redeemable 1-for-1 for the real thing. A basket of signers — 15 of them, of which 11 must agree — guards that wallet. This is the "trust the federation" model, and its selling point has always been that it takes a huge, coordinated compromise to move reserves.

That model did not break. According to reporting on the incident, the exploit started in Elements, the open-source software Liquid runs on. A bug allowed the creation of L-BTC that was never backed by any real bitcoin. About 4,000 of those unbacked tokens were submitted to SideSwap, a federation member that processes peg-outs — the mechanism by which users burn L-BTC to receive real bitcoin. Because the tokens passed the software's validity check, the burn was authorized, and the signers did their job: 11 of the 15 keys signed the transaction. The federation then released roughly 3,996 bitcoin to the attacker's address. One analysis attributed the root cause to a cache-key collision in the confidential-transaction verification logic.

Trace the sequence and the lesson is not "they guessed the password." It is that the authorization check — the multisig — ran on software that was told the tokens were valid when they were not. Keys protect custody. They cannot protect a reserve from a validator that blesses counterfeit claims.

Follow the payment, then read the "white-hat" claim.

The attacker did not just leave. They left a message: from the stolen bitcoin came an on-chain note identifying the group as "white-hat" hackers and a condition — fix the bug, patch every node, then the funds come back. Blockstream replied on-chain, agreeing to patch first; a PGP-signed message at 09:19:46 UTC on September 7 confirmed the bridge nodes were fixed and it was "safe to return the funds." The attacker then returned 3,400 bitcoin, about 85 percent of the haul, and kept roughly 598.5 bitcoin, worth around $47 million at the time.

That sequence is what separates two very different reads. The charitable one: these were researchers who demonstrated a flaw, held a negotiating position, and handed back most of the money the moment the fix landed. The skeptical one, which several prominent figures took: you do not drain a bridge and then solicit contact; taking assets first and announcing good intent afterward is leverage, not responsible disclosure. Ledger's CTO put it plainly — white hats don't drain a bridge and then ask for on-chain contact — and former Blockstream CSO Samson Mow noted that a Signal request to "contact" the hackers did not originate from the address holding the 4,000 bitcoin. Before returning the funds, the group had demanded a 10 percent bounty paid from Blockstream's own money, threatening that holders would take the loss otherwise.

Blockstream's verdict, as of September 11, is that it will not pay that ransom. It frames the retention as theft — taking assets without authorization and withholding their return — not as pitiable responsible disclosure. That is the correct legal box to draw, for now.

What the peg was, and what it is now.

Before this event, an investor holding L-BTC could plausibly reason: my token is backed by real bitcoin, held under multisig, and therefore it will redeem at one. That reasoning failed not at the custody layer but one layer up, at the software that decides whether a redemption request is genuine. The invariant that made the token "as good as bitcoin" — token supply can never exceed real backing — turned out to be conditional on code that had gone years without an update.

The repricing here is not in bitcoin itself. BTC's price held near $80,000 through the drain, and the broader market barely blinked, consistent with a regime where a $320 million sidechain event no longer moves the base-asset price. The bill comes due in a narrower currency: trust and liquidity in the tokenized layer. Liquid is paused, L-BTC peg-outs are blocked, and exchanges have suspended deposits and withdrawals, so anyone holding L-BTC is sitting on a redemption that does not currently work.

None of that makes the underlying theory of sidechains wrong, and none of it indicts every bridged asset. But it does redraw the boundary of what "1:1 backed" means to a retail holder. The claim is only as strong as the least-recently-audited software standing between the reserve and the token, and the multisig is the door, not the guard. If you hold a wrapped bitcoin, the question to ask is not "who signs," but "what could make the signers sign for a token that was never really there." The break condition for the reassuring read of this story is now observable: whether tests can reproduce the minting of unbacked L-BTC at all, and whether the remaining 598.5 bitcoin are recovered and the peg restored so that circulating L-BTC again equals real bitcoin, dollar for dollar, and stays that way after the auditors leave.

Until that is demonstrated, the honest label on any L-BTC is not "as good as bitcoin." It is "a claim on a reserve whose backing just went through a documented, uncorrected failure."