Liquid lost $320M and no key was stolen: what a forged receipt teaches about pegged bitcoin

At 15:53:10 UTC on September 6, in Liquid block 4,050,336, roughly 4,000 bitcoin that should not have existed were spent as if they did. A minute later, in normal-clock terms, the federation wallet behind a token called L-BTC had fallen from about 4,205 bitcoin to 197 — roughly $320 million gone out of one window, about 95% of the sidechain's entire reserve. Then the network went quiet, the way these days do: bridge nodes disabled, deposits and withdrawals on several exchanges suspended. What follows is the record, set down while it is still warm.

Here is the part the headline gets wrong. No cryptographic key was stolen. The multisig held. The vault door did not open. Something more interesting happened, and it is the thing a holder of any "pegged" bitcoin needs to understand.

The vault held. The cashier did not.

Liquid is a Bitcoin sidechain built and run by Blockstream — a separate way to move value, used by exchanges for fast and private settlement. Legitimate money works like this: you send real bitcoin in (a "peg-in") and get an equal amount of L-BTC out; later you "peg out," burning the L-BTC to get the real bitcoin back. The real bitcoin sits in a federation wallet guarded by an 11-of-15 multisignature arrangement across roughly 80 member companies. On paper, every circulating L-BTC is backed 1:1 by real bitcoin in that wallet. On paper.

The attack did not touch the wallet. It touched the ledger software. Liquid runs on an open-source project called Elements, and Elements validates transactions using "range proofs" — cryptographic checks meant to guarantee that nobody can create an asset out of thin air. To save work, nodes cache the results of past checks. The exploit abused that cache: a flaw in the system used to identify cached checks allowed new, invalid data to be mistaken for previously approved data. Roughly 4,000 L-BTC were minted with no deposit behind them.

Then the counterfeit tokens went out the front door. SideSwap, an authorized settlement service, burned the 4,000 L-BTC through the normal peg-out path, and the federation released about 3,996 real bitcoin to the attacker's address. Think of a bank whose vault is solid and whose managers sign properly, but whose ledger accepted a forged deposit slip and paid it out as cash. The keys did their job. The books were wrong about what was on deposit.

Both Liquid and SideSwap have confirmed the authorization keys — SideSwap's peg-out key and the federation signatures — were never compromised. The failure was software: a convergence of individually low-probability factors that defeated the system's redundancies.

A return negotiated in public

The group did not run. It posted a public message on the Bitcoin mainchain identifying as "we are whitehats" and said it would hand the funds back once the vulnerability was patched. Blockstream pushed a fix to its bridge nodes at 01:09 UTC on September 7. On September 7 at 16:09:25 UTC, the group sent 3,400 bitcoin — about 85% of the drain — back to the federation wallet.

The remaining 598.5 bitcoin, worth roughly $47 million at the time, has not come back. The group has called it a bounty; neither Blockstream nor the federation has confirmed authorizing it. Ledger's chief technology officer has publicly floated the word "extortionate" for a negotiated reward of that size. This part belongs in the record as claimed, not settled: a demanded-and-partially-rendered return is coordination with conditions, not insurance.

The network remains paused as of this writing. Holders cannot peg out — they cannot get their L-BTC back into bitcoin while it is frozen. Liquid says the other assets on it (like its USDT) were not compromised, only temporarily unavailable with the network.

What it costs to trust a peg

Here is the translation for an ordinary investor. When you hold L-BTC — or, more commonly, any pegged or "wrapped" bitcoin, the WBTCs and cbBTCs of the market — you are not holding bitcoin. You are holding a claim that rests on two separate promises: custody (that the collateral is really there and really guarded) and validity (that the software cannot be tricked into treating invented value as real). This week produced a clean, dated demonstration that the second promise can fail completely while the first holds perfectly. The safe was fine; the count was wrong.

That distinction is also why this week is a test of a larger container, not just one project. The value recovered only through a negotiated return after a patch — nothing in it was guaranteed by the design. And the hole is exactly where the current market pressure lives: bitcoin is trading near $77,000, roughly 38% below its 52-week high, and U.S. spot bitcoin ETFs logged back-to-back net outflows this month as the price slipped under $78,000. An episode that drained 95% of a sidechain's reserve lands in the middle of an already-fragile institutional story — the argument that this infrastructure is "not ready for prime time" for banks.

Two prints would decide whether this stays a contained, if alarming, week or becomes a case study. First, the record's: when the network reopens — the emergency Elements release is staged — does it come back with 1:1 backing, the ~598.5-bitcoin gap covered by the federation? A full reserve on restart writes "contained" into the ledger; a permanent hole writes "depeg" into it. Second, the map's: does the trust premium afterward stay with the pegged layer that just forgave a forged receipt, or does it migrate back to plain bitcoin, where value is created by consensus rather than by a cached check? Watch the flows. The safe is fine. The count is the story.