Project
Open-source Bitcoin sidechain codebase used to build federated chains like Liquid, adding features such as confidential transactions and issued assets.
Blockstream has not said whether its 11-of-15 federation was bypassed or complied. Until someone publishes what share of Liquid's reserves left on September 6, an L-BTC balance is an unverified claim.
Perspective Coverage
7 publishersReality
The attackers who drained 4,000 BTC from Liquid handed back 3,400 after the patch and kept 598.5. Blockstream puts about $47 million on that hold and says it will trace the coins instead of paying.
Perspective Coverage
7 publishersReality
Blockstream paused the Liquid bridge after roughly 4,000 BTC left the federation wallet, and the people holding it will send most of it back only once the flaw is fixed, which puts the patch timetable in their hands.
Perspective Coverage
7 publishersReality
Coinkite's Coldcard firmware skipped its hardware random number generator, letting attackers brute-force seeds and drain over $100 million in bitcoin. Liquid's later $320 million drain adds node software to the code a bitcoin holder has to trust.
Reality
Blockstream says none of the 15 federation keys were compromised, which is what makes the $320m peg-out worth studying: honest signers running buggy validation code approved it, and the reserve is still short.
Reality
The withdrawal cleared every control the Liquid Federation actually operates, which is why an 11-of-15 quorum released the bitcoin in 23 minutes. Recovery now depends on whoever holds the coins answering an email address.
Reality
The 11-of-15 federation multisig held and no key was stolen; the node software that tells signers whether a peg-out is backed carried a week-old bug, and about $320m walked out of Blockstream's sidechain.
Perspective Coverage
5 publishersReality
SlowMist says a cache key collision in Blockstream's Elements let an attacker mint 3,998.5 L-BTC and peg them out for real Bitcoin. About 3,400 BTC came back after the patch, leaving the pool near 3,597.
Reality
Blockstream's federation signers behaved correctly and still released roughly 4,000 bitcoin, because the software that decides what counts as a real L-BTC is a different system from the keys guarding the peg.
Reality