A single withdrawal nearly emptied the Bitcoin reserves behind Liquid, a Blockstream-launched network that lets people move BTC onto a faster sidechain, and the attackers now say Blockstream should cover the remaining roughly $47 million gap itself or leave users with a 15% loss.
Liquid is supposed to keep every token backed by real bitcoin
Liquid, launched by Bitcoin infrastructure company Blockstream in 2018, is a sidechain that lets users move BTC away from the main Bitcoin network for faster transfers, trading and asset issuance.
- The basic idea is simple. Users send BTC into a wallet controlled by a group of Liquid operators, known as the federation, and receive the same amount of L-BTC on Liquid.
- One L-BTC is supposed to always represent one real bitcoin held in reserve.
But that backing broke during the Sept. 6 exploit as attackers found a bug in Elements, the software Liquid runs on, and were able to create roughly 4,000 L-BTC that were not backed by real Bitcoin.
They then sent those tokens to SideSwap, a Liquid-based trading service and federation member that can process withdrawals from Liquid back into regular BTC. And SideSwap let almost the entire amount out.
The service processed a 4,000 L-BTC withdrawal "like any other order," and about 3,996 real BTC left the federation wallet roughly 23 minutes later.
SideSwap's documentation had also advertised peg transactions with "no size limitations," wording that disappeared after the incident, The Coinformer noticed.
So the software bug created fake L-BTC, but the lack of a withdrawal cap meant one transaction could drain almost all of the real bitcoin sitting behind it.
Most of the Bitcoin came back, but not all of it
The attackers returned 3,400 BTC on Sept. 7 but kept about 598.5 BTC, currently worth roughly $47 million.
The Coinformer first flagged the controversy over the size of that apparent bounty the same day, asking Blockstream and SideSwap whether keeping nearly 15% had actually been agreed and who would cover the remaining shortfall. Neither responded.
Now the attackers have made their position public.
In a new on-chain message on Wednesday, they told Blockstream to pay a 10% bug bounty "using your own money" or, they claimed, leave holders facing a 15% loss.
The network also remains offline. Liquid said it plans to restore operations only after an emergency Elements update is reviewed and the network returns with 1:1 BTC backing.
Blockstream, the company that develops Liquid's software, separately said updated software had been deployed and federation members were preparing a "coordinated restart."
SideSwap has since returned roughly 4 BTC in fees generated by the original withdrawal, slightly reducing the gap.