Liquid requires eleven out of fifteen signatures to move the BTC reserve that backs the 1:1 peg with L-BTC tokens.
On September 6, 83 inputs collected the eleven signatures required by the standard spending path. 4,000 BTC left the federation.
CertiK reconstructs the exploit as follows: the attackers reused a successful result and bypassed the verification step that should have rejected the inflationary issuance.
Side Swap says it installed, on August 13, a security build that had been privately distributed to Liquid members. That build accepted the transaction. SideSwap also admits that it had left the Peg-out Authorization Key online, automated forwarding, and implemented no controls on withdrawal amounts or frequency.
The attackers wrote on Bitcoin: “We are white hats. Contact us on-chain.” They returned 3,400 BTC. They kept roughly 598.5 BTC and demanded a 10% bounty, threatening a 15% loss for L-BTC holders. Blockstream refused.
A reserve can be replenished. The trust required by a federation, by privately distributed updates, and by automated custody processes cannot be restored with a patch.
The rest of the protocols designed to make Bitcoin easier to spend are not doing much better: we are looking at a Layer 2 apocalypse.
naddr1qqsk...
On September 6, 83 inputs collected the eleven signatures required by the standard spending path. 4,000 BTC left the federation.
CertiK reconstructs the exploit as follows: the attackers reused a successful result and bypassed the verification step that should have rejected the inflationary issuance.
Side Swap says it installed, on August 13, a security build that had been privately distributed to Liquid members. That build accepted the transaction. SideSwap also admits that it had left the Peg-out Authorization Key online, automated forwarding, and implemented no controls on withdrawal amounts or frequency.
The attackers wrote on Bitcoin: “We are white hats. Contact us on-chain.” They returned 3,400 BTC. They kept roughly 598.5 BTC and demanded a 10% bounty, threatening a 15% loss for L-BTC holders. Blockstream refused.
A reserve can be replenished. The trust required by a federation, by privately distributed updates, and by automated custody processes cannot be restored with a patch.
The rest of the protocols designed to make Bitcoin easier to spend are not doing much better: we are looking at a Layer 2 apocalypse.
naddr1qqsk...
11❤️3