Overview
- On Sept. 6 a single peg-out processed through SideSwap moved about 3,996 BTC from Liquid’s federation wallet after a corresponding burn of L-BTC.
- SideSwap and Blockstream say SideSwap’s Peg‑out Authorization Key was used but not compromised, and preliminary analysis points to an Elements node validation bug that let invalid L-BTC enter the peg-out flow.
- The peg-out drained roughly 95% of reported reserves, leaving about 197–207 BTC in the federation vault and prompting exchanges to halt L‑BTC deposits and withdrawals.
- The address controlling the withdrawn BTC posted on‑chain messages claiming to be ‘whitehats’ and offered to return most funds after Blockstream issues and deploys a patch, but no repayment has been confirmed.
- Restoring trust will require a public technical postmortem, a verified patch rollout across functionaries, a full reserve reconciliation and clear rules for how users can safely redeem or access their L‑BTC.