The Liquid Network recovered 3,400 BTC on September 7, returning approximately 85% of Bitcoin taken from its federation wallet over the weekend. However, the recovery does not resolve underlying concerns about how the incident occurred.
On Sunday at 14:05 UTC, a customer transmitted 4,000 L-BTC to SideSwap's peg-out service with valid authorization. At 14:28:56 UTC, approximately 3,996 BTC was released from the federation's wallet. The transaction appeared routine and properly authorized, but investigation revealed a critical distinction: the authorization key was not compromised.
Blockstream determined that a software failure in Elements enabled the generation of invalid L-BTC that appeared legitimate through the peg-out mechanism. According to Liquid's design, L-BTC should only be created when Bitcoin enters the sidechain through a two-way peg backed by Bitcoin held in federation reserves. The vulnerability allowed invalid tokens to pass redemption checks without proper backing.
Communication between Blockstream and the actors handling the funds occurred through messages embedded in Bitcoin transactions. After Blockstream sent a signed message stating that bridge nodes were patched and funds could be safely returned, the actors transferred 3,400 BTC back to the Liquid Federation at 16:09:25 UTC on September 7.
Approximately 598.5 BTC remains unrecovered, representing a gap in the federation's reserves. The incident exposed a distinction from typical security breaches: rather than a stolen authorization key or compromised base layer, the vulnerability lay upstream where falsely minted L-BTC successfully passed through redemption mechanisms designed to release actual BTC.
For users of bridged Bitcoin, the event demonstrated how a software defect can generate redemption requests that appear valid without actual reserves to support them, raising questions about reserve integrity in sidechain systems.
