Liquid Network Stays Paused With 598 Bitcoin Unreturned After Software Approved an Unbacked Withdrawal

Almost 4,000 bitcoin left the reserve backing Blockstream's Liquid sidechain on 6 September through a withdrawal the network itself approved, and the case is still unresolved. CryptoSlate's account makes the uncomfortable point plainly: the private keys used to authorize the transfer were never stolen. Software accepted a withdrawal that should never have qualified.

Liquid lets holders move a bitcoin-backed token, L-BTC, across a federated sidechain, with real bitcoin locked in a multi-signature wallet run by the federation. Early analysis pointed to a defect in Elements, the software Liquid runs on, which let the attackers create L-BTC that no bitcoin ever backed and then redeem it. Eleven of the fifteen federation keys signed the resulting peg-out, which is exactly what those keys are designed to do when a request looks valid. Roughly $320 million in bitcoin left through a process that was functioning exactly as designed.

The attackers left an on-chain message describing themselves as white-hat researchers. After Blockstream confirmed it had patched the flaw, they returned about 3,400 bitcoin and kept roughly 598.5 bitcoin, worth around $47 million, which they characterized as a self-appointed bounty. Ledger's chief technology officer and other researchers rejected the white-hat framing and compared the event to the Ronin bridge theft. Liquid remains paused. Rekt News has catalogued the incident alongside the month's other federated and bridge failures.

Both interpretations benefit someone. If the attackers are researchers, keeping $47 million without a prior agreement is still an unauthorized taking, and it sets a price for future disclosure that no protocol negotiated. If they are thieves, the partial return was a practical hedge against being identified. Neither party has produced evidence that settles it.

The unresolved question is who absorbs the loss. Liquid's structure gives holders a claim on a federation, not on a chain, and the federation followed its own rules. Custodial insurance generally responds to key compromise and theft, not to correctly signed transactions authorized by faulty accounting software. That gap is the real finding here.