Nearly 4,000 BTC were withdrawn from the Liquid Federation wallet after attackers created unbacked L-BTC and used SideSwap’s peg-out service. Liquid said the tokens appeared valid, while SideSwap processed the request normally; about 23 minutes later, 3,996 BTC were sent to the supplied Bitcoin address. The actors later returned 3,400 BTC after affected bridge nodes were patched, leaving about 598 BTC outstanding as of September 10. Liquid resumed block production but had not restored transactions or peg operations.

Rootstock co-founder Sergio Lerner argues that mandatory withdrawal delays could turn similar validation failures into containable incidents by giving monitoring systems and operators time to detect missing collateral and halt settlement. Rootstock’s PowHSM devices already enforce a 4,000-block, roughly 36-hour delay before signing peg-outs; compromised functionaries can pause the process but cannot force an early withdrawal. Lerner also points to draft BIP-443 as a possible route for Bitcoin-native vault controls, though the proposal remains unactivated.

https://crypto.news/bitcoin-time-delay-lock-prevent-bridge-bug-from-losses/