Overview
- The withdrawal began Sunday, Sept. 6, when about 4,000 L‑BTC were presented to SideSwap and redeemed for roughly 3,996 BTC from Liquid’s federation reserve.
- Blockstream and multiple observers traced the loss to an Elements range‑proof verification/cache bug that created unbacked L‑BTC rather than to stolen private keys.
- Federation operators immediately disabled bridge nodes and paused L‑BTC deposits and withdrawals while developers distributed patches and prepared a coordinated restart.
- On confirmation that bridges were patched, the self‑identified white‑hat actors returned about 3,400 BTC but kept roughly 598 BTC outstanding, leaving a shortfall in reserves.
- The incident exposes a systemic risk in federated custody where consensus/validation bugs can produce signed but invalid state and will likely prompt deeper audits, legal scrutiny of 'take‑first' disclosure, and tightened exchange safeguards.