They didn’t even bother to steal all the money, a huge amount was left vulnerable. Also, specifically to liquid, they have back doors to halt the system so reporting it to them can likely get the issue locked down faster than you can exploit it.

Finally, they kept 15%? That’s not even remotely white hat behavior. They just wanted to use the term “whitehat” to reduce risk of FBI.

Yea that’s the bug, but that’s not the fix. That was an attempted fix but in fact it was incomplete, the exploit, afaiu, exploited the patched code.

Well, yes, an individual tx that was invalid, just not crypto code failing to check it.

Nah, it was not an individual tx that was wrong. Based on a few people’s LLM’s analysis that looks right it was a higher level consensus failure not the crypto code.

I saw someone saying mempool didn’t accept that block. Unclear what’s going on I haven’t really dug into things

No, means “boy this shouldn’t have happened”

There was supposed to be a whitelist of withdraw addresses. Maybe it was also a break in the range proof but there would have had to be a second bug. Seems more likely there was a software bug in the peg out verification more generally.

I’ve seen that claim, but zero evidence for it.

This is the thing that gets me. That should have been an easy protection against this kind of hack.

Qwen3.8-Flash-Next is smarter and needs less VRAM anyway 🤷‍♂️

Oof 3bpw? That’s usually pretty lobotomized.