About 4,000 bitcoin, worth about $320 million then, was withdrawn from the federation wallet that backs Blockstream’s Liquid Network on 6 September, after a flaw in the Elements software let someone create L-BTC tokens that were never deposited and redeem them through the ordinary peg-out process. The federation paid out 3,996 bitcoin before the withdrawal was caught, and reserves fell from about 4,200 bitcoin to below 200. Blockstream halted the sidechain the same day.
The party behind the withdrawal described it as a white-hat action and contacted Blockstream through messages in Bitcoin transactions and encrypted text, telling the company to fix the bug and confirm every node was patched before anything came back. Blockstream, led by Adam Back, replied with a signed on-chain message saying the bridge nodes were patched and it was safe to send the funds back. On 7 September about 3,400 bitcoin, roughly 85%, was returned. Around 598 bitcoin, about $47 million, was not.
Liquid is a federated sidechain, run by a fixed group of functionaries rather than an open validator set, a design meant to make this kind of failure easier to contain. In one sense it worked, because the chain could be stopped and patched within a day. It did not stop the mint, and the recovery rested on the person who took the coins choosing to give them back.
Blockstream has not said how the invalid tokens passed validation, how long it had been open, or whether any returned bitcoin moved through services that now cannot reconcile their books. The missing 598 bitcoin sits at an address the company does not control, held by someone whose one stated condition has already been met. The chain is still paused. The reserve is still short.
