Liquid's Missing 598 BTC: How a 1:1 Peg Bent Without a Stolen Key — and Who Pays for It

On the evening of September 6, roughly 4,000 bitcoin walked out of the wallet that backs Liquid, Blockstream's Bitcoin sidechain. The reserve held about 4,200 BTC at the time, so that was roughly 95% of it, worth around $320 million, gone in effectively one transaction. The detail that keeps the story alive is not the size. It is that no private key was stolen: the withdrawal carried 11 valid signatures in the federation's 11-of-15 multisig, and the network's peg-out authorization key was never compromised.

Here is what the ledger says. Liquid issues a token called L-BTC, minted one-for-one against bitcoin held by the "Liquid Federation," a group of fifteen functionaries who keep keys in separate hardware modules. The entire premise — why exchanges and traders put value on a sidechain at all — is that every L-BTC is backed by real bitcoin sitting in that wallet. On September 6 that backing briefly became fiction, and the price of the token did not change to tell anyone.

The exploit turned a 1:1 peg into an unbacked claim

The failure was not in the custody keys but in the software that sits in front of them. A consensus bug in Elements, the open-source code Liquid runs on, let an attacker mint about 4,000 L-BTC out of nothing — tokens created by a validation error instead of a peg-in of real bitcoin. Those unbacked tokens were routed through SideSwap's peg-out service, which burned them and, using its valid authorization key, asked the federation to release the equivalent bitcoin. The functionaries verified the burn proof, found it acceptable, and paid out the real BTC. From the federation's side every step was signed and legitimate; the corruption was upstream, in the code deciding the burned L-BTC had ever been earned.

That is the identity switch the incident exposes. Before the bug, an L-BTC was interchangeable with bitcoin in the eyes of the network — same value, same redemption guarantee. In the minutes of one peg-out, L-BTC representing nearly 4,000 BTC stopped meaning "backed by bitcoin" and started meaning "a claim on a reserve that had been drained to roughly 197 BTC." The two tokens wore the same name; their redemption rights were, for a time, completely different. No headline marked the change, because nothing on the Liquid chain itself revalued.

Blockstream patched the bug (an emergency Elements release hardening the range-proof cache that caused it), and on-chain messages from the attackers, calling themselves "white hats," were answered. They returned 3,400 BTC the next day, about 85% of what they took. They kept 598.5 BTC, worth roughly $47 million, as an apparent bounty.

The 15% they kept was the 15% they predicted

The arithmetic deserves a sharp stare. 3,400 of 4,000 returned, about 600 kept — 85% and 15%, respectively. During the negotiation the group had warned that without payment, Liquid asset holders would face a 15% loss, and they had demanded a 10% bounty be paid from Blockstream's own funds. Blockstream refused the ransom. Yet the final split delivered almost exactly the 15% haircut the attackers had threatened, applied not to L-BTC itself but to the reserve backing it. Whether that retained 598 BTC is a negotiated bounty or simple withholding is genuinely unclear — neither party has publicly confirmed a deal — but the outcome lands on the number they named in advance.

On September 11, Blockstream said it would not pay: "Taking assets without authorization and withholding their return is a crime, not responsible disclosure... This is theft," and it said it would bring in law enforcement, exchanges, and blockchain forensics firms to trace the outstanding funds.

The investment question is who eats that hole. Bitcoin's own network was never at risk — this is a sidechain problem, not a Bitcoin protocol problem — so the market's reaction has been muted. BTC is down modestly over the week, and futures flows have stayed net positive, which is the honest way to say the incident did not move the broad market. The loss is concentrated, not systemic.

That leaves three places for the missing 598 BTC to land. Liquid's own operator, Blockstream, is a private company; there is no ticker to buy or short. If the promise holds, the shortfall is absorbed on a private company's balance sheet as a cost of standing behind its product. If it does not, the unit-holders who trust the peg — exchanges and their customers holding L-BTC — carry the haircut, and the "1:1" label becomes a marketing statement rather than a settlement fact.

A pledge is not a redemption

To his credit, Blockstream CEO Adam Back has said plainly that the 1:1 L-BTC peg "will be covered" and urged holders not to panic-sell. That is the right message, and it is also the thing a careful reader refuses to accept on faith. A speech is not a settlement, and a promise to cover a peg is not the peg being covered. The whole history of negotiable instruments is a warning about the gap between an issuer's word and the metal actually in the vault.

Blockstream laid out a three-stage recovery: resume block production with transactions suspended (now live, with empty blocks), replay transactions verified as valid, and only then reopen peg-in and peg-out operations — the moment holders can actually turn L-BTC back into bitcoin. That third step is the entire ballgame. The "1:1 peg" only exists when a peg-out can be re-opened against a published reserve that matches circulating L-BTC. Until that stage completes, every confident statement about the peg is a corporate pledge with a dollar amount attached, not a demonstrated fact.

So the analogy that often gets attached to sidechains — L-BTC as a clean, redeemable stand-in for bitcoin, like a banknote redeemable in gold — holds only while one condition is true: redemption is actually honored. The moment the reserve is short and the word "redeem" stops being checkable, the note and the metal are two different things, and which one you hold matters a great deal.

That is the break condition the reader should keep. It is not, as the teaser headline suggests, "will Blockstream pay a ransom" — they have already refused, and the withheld 598 BTC is now a legal and balance-sheet matter, not a negotiation. The fact that would change the dossier's central read is narrower and more technical: the day peg-outs reopen and the published reserve provably matches the L-BTC in circulation. If that day comes with clean numbers, the peg was restored and the missing 598 BTC was a cost Blockstream ate. If peg-outs reopen against a shortfall that is instead absorbed by holders, then the 15% figure was never a threat — it was the settlement. Watch Stage 3, not the headlines.