On September 6, an attacker exploited a bug in Liquid Network — a Bitcoin sidechain built by Blockstream that more than 80 exchanges and infrastructure firms use as a faster settlement layer — to mint roughly 4,000 bitcoin that weren't actually backed by any reserve, then withdraw about $319 million of it through an approved trading platform called SideSwap. The whole sequence, from the first malformed transaction to the payout leaving the network, took about 36 minutes.
How a sidechain works, and how this broke it
Liquid issues a token called L-BTC, meant to be backed one-to-one by real bitcoin held in a multi-institution reserve called the federation wallet — the idea being that L-BTC settles faster than bitcoin's own base chain while staying redeemable for the real thing. The bug lived in Elements, the open-source software Liquid runs on: nodes cache the results of range-proof checks, a cryptographic step that verifies a transaction's amounts are valid, to save on repeated computation. A flaw in that caching let at least one invalid output pass as already-verified — effectively letting the attacker mint L-BTC without putting up real bitcoin behind it. Blockstream confirmed this was a software bug, not a stolen private key or a breached wallet.
The conditional return
The attacker communicated on-chain, describing themselves as a "whitehat" and telling Blockstream, in effect: fix the bug first, and the money comes back once the fix is confirmed. Liquid halted all transactions while the federation worked on a patch. After it shipped, the attacker returned about 3,400 BTC — roughly 85% of what was taken, worth about $272 million — and kept the remaining 598 BTC, worth around $47 million.
“Please fix the bug first... Then we will transfer the money back safely after confirming the fix,” the attacker wrote in an on-chain message.
What's still unresolved
Blockstream hasn't detailed how it plans to cover the roughly $47 million shortfall the attacker kept, or when full redemptions will fully resume for L-BTC holders. Reconstructions of the federation's reserve after the returned funds put the implied backing ratio somewhere around 86% against outstanding L-BTC — not fully reconciled, and not the one-to-one peg the token is supposed to guarantee. Liquid has since resumed operations.
Why this matters beyond one sidechain
This is a useful, concrete counterweight to a week of otherwise upbeat regulatory news — the SEC's new tokenized-stock exemption, the CFTC's own rulemaking push, a 21-bank stablecoin venture all landed the same stretch of days. None of that changes the fact that a settlement network used by major exchanges ran on software with a caching bug nobody caught until it cost $319 million. Regulatory clarity and infrastructure security are different problems, and this week is a reminder that solving one doesn't solve the other. Whether "whitehat" conduct after the fact should change how anyone thinks about the underlying failure is a fair question worth sitting with, not an answer this piece is trying to supply.