Blockstream's own account of Liquid's roughly $320 million hack describes an old software flaw as critical, less than two weeks after its CEO, Adam Back, described the bug that its faulty patch was meant to fix as "non-critical."
- In a Sept. 10 post, Back said the exploit involved an incorrect fix to what he described as an AI-found "non-critical bug."
- But Blockstream's Sept. 23 report gives that original flaw, which it calls Bug A, a much more serious label: "This was a critical consensus bug. Under the right conditions, one node could reuse a previously cached result and accept a rangeproof in a context where it was not actually valid, while another node without that cached result would reject the same transaction," the report reads.
The vulnerability ultimately exploited on Sept. 6 was different. Blockstream says Bug B was introduced by the patch created to fix Bug A.
An outside researcher reported the flaw privately to Blockstream on Aug. 2 and proposed two fixes, according to Blockstream. The company chose the narrower one.
- The researcher's alternative used length-prefixed serialization, which Blockstream now acknowledges provided "stronger separation" between those fields.
Timeline of Blockstream's response to Liquid Bug A. Source: Blockstream
Blockstream says the broader fix targeted a different, non-production branch and went beyond what engineers believed the reported vulnerability required. Its chosen fix passed internal, external and AI-assisted review by Kimi-K3. But none caught Bug B.
- On Sept. 6, an attacker exploited the Bug B to create roughly 4,000 L-BTC with no Bitcoin backing them, then converted them into real Bitcoin through SideSwap's peg-out service.
- The actors identified themselves as "whitehats" and Liquid initially described them as "purported white-hat hackers."
- They returned 3,400 BTC after negotiating with Blockstream but kept roughly 600 BTC.
- But then Blockstream's tone quickly changed.
- On Sept. 11, it said withholding the remaining Bitcoin was "theft," rejected the actors' demand for a bounty and said it would work with law enforcement, exchanges and forensic firms to recover the funds.
- Its new report says approximately 602 BTC remained outstanding as of publication.
- Blockstream didn't respond to The Coinformer's request for comment.