Seventy. That is the number of rehearsal transactions the attacker ran before the one that mattered. Not three probes. Not a single test. Seventy dry runs through the same execution path, each one a cheap, low-noise confirmation that the pegged-asset validation on Liquid would accept L-BTC that no bitcoin backed.
On the seventy-first attempt, roughly 4,000 unbacked L-BTC were minted and pushed through a peg-out service. Approximately 3,996 BTC left the federated wallet. The algorithm broke, so the money evaporated — and it evaporated with the ledger's full consent.
Then came the part that converted a security incident into an industry-level argument. The attacker returned about 3,400 BTC — 85% of the haul — and moved to keep the remainder as a bounty. Blockstream refused.
Roughly 598.5 BTC is still outstanding. L-BTC coverage sits near 85%. Every federated bridge operator, every wrapped-asset issuer, and every desk holding a pegged BTC product is now watching the terminal state of this negotiation, because whatever number gets set here becomes the reference price for attacker cooperation across the entire market.
Context: What Liquid Actually Is, and What It Actually Trusts
Liquid launched in 2018 as a Bitcoin sidechain. It is not a rollup. It is not a ZK bridge. It is a federated peg — a construction in which a pre-selected set of signers, operated by Blockstream, controls the mainchain wallet that custodies BTC backing the sidechain asset.
That design buys real things. Two-minute blocks instead of ten. Confidential Transactions, which hide amounts and asset types on-chain. Native issuance rails for institutional assets, which is why Tether's USDT lives there and why various RWA issuers have used it. Total value across Liquid has hovered in the billions at peak, with a meaningful share of that in wrapped BTC and stablecoin float.
The federated peg also buys one specific liability: trust consolidation. Compared with a merge-mined chain like Rootstock or a relay-verified bridge, Liquid's security model reduces to the honesty and the operational competence of a small signer set — conventionally cited in the low double digits. That is not a flaw in the design. It is the trade. You optimize the node, secure the chain — but only to the extent that the node operators are the thing you are willing to trust.
L-BTC is the asset at the centre of this. It is not a governance token. It is not a utility token. It is a 1:1 claim on mainchain bitcoin, minted when BTC enters through peg-in and burned when BTC exits through peg-out. Its entire value proposition is a single invariant: supply of L-BTC equals bitcoin held in the federation wallet. Break the invariant and you have not broken a token — you have broken an accounting identity that the market had been pricing at par.
SideSwap is the second actor worth naming. It is a peg-out service provider, a practical channel through which L-BTC holders convert back to mainchain BTC. The attack passed through it. SideSwap has stated it cooperated, returned fees, and provided tracing information. Whether that is sufficient insulation from user litigation is a separate question, and the answer will be decided by courts, not by GitHub issues.
Core: The Arithmetic, the Missing Check, and the Leverage Nobody Priced
Start with the ledger, because the ledger is the only part of this story that does not have a public relations department.
- Roughly 4,000 unbacked L-BTC minted
- Roughly 3,996 BTC extracted through peg-out
- Roughly 3,400 BTC returned
- Roughly 598.5 BTC outstanding
- Coverage on the L-BTC float: approximately 85%
The attacker's own framing put the shortfall at about 15%. That framing is accurate as arithmetic and misleading as an argument. A 15% hole in a pegged asset is not a rounding error. It is the difference between a claim trading at par and a claim trading at 0.85. Adam Back has publicly urged holders not to sell L-BTC at a discount, and has committed that the peg will eventually reach full 1:1 coverage. What has not been published is the path. No funding schedule, no treasury commitment line, no technical remediation timeline.
Based on my audit experience, that silence is the single most load-bearing fact in this story. In 2020, while finishing my MS in Economics, I found an integer overflow in an early Compound governance module and filed a standardized bounty report through GitHub rather than waiting for someone else to notice. It paid $5,000 and a formal acknowledgement. The lesson was not about the money. The lesson was that the value of a disclosure is set entirely by the published rules governing it. Where rules exist, honesty is cheap. Where rules do not exist, honesty has to be negotiated, and negotiation is where attackers extract premium.
The missed check is not exotic. Any bridge that mints a representation of an external asset needs a reconciliation loop. What was missing on Liquid's issuance path was functionally this:
# reserve reconciliation — the invariant any wrapped-asset desk should verify
# before sizing a position in a pegged assetdef audit_peg(lbtc_supply, btc_reserve, tolerance=0.005): coverage = btc_reserve / lbtc_supply if coverage < 1 - tolerance: raise InsufficientReserve(coverage)
# every mint event must map to a confirmed mainchain deposit for mint in pending_mints: if mint.mainchain_txid not in confirmed_deposits: raise UnbackedIssuance(mint.id)
return coverage ```
I wrote a variant of this in late 2023 for Solana RPC monitoring, after watching transaction failure rates eat my bots' edge. It cut failures by 15% and got forked a couple of hundred times. The script is not clever. That is the point. The check does not need to be clever. It needs to exist, it needs to run on every issuance event, and it needs to halt the mint rather than log a warning.
Seventy rehearsal transactions tell you the attacker validated that halt condition was absent. Over multiple pre-attack runs, the path accepted unbacked issuance without rejection. That is not luck. That is a control gap with a confirmation loop built into it.
Now the part that most coverage has gotten wrong: the attacker's position is not a 598.5 BTC war chest. It is a short position on its own liquidity.
Consider the payoff matrix. Return everything and the attacker receives an undefined, unnegotiated discretionary payment — good will with no contract. Keep everything and the coins sit in wallets that blockchain forensics firms have already tagged, with exchange deposit paths wired into compliance systems that have had two years of Tornado Cash practice. Return part and retain partial leverage — which is exactly the state we are in — and the leverage only works if the counterparty is willing to pay for it. Blockstream declined. So the remaining 598.5 BTC is an asset with a bid-ask spread measured in legal risk.
Bitcoin researcher Alex Waltz has made the operational version of this argument. Moving BTC through exchanges leaves traces. Mixing through Tornado Cash complicates provenance but does not create a clean exit. The funds exist on the ledger. They do not exist in the economy. For an attacker, that distinction is the whole game.
Tornado Cash deserves its own line because it converts a technical choice into a regulatory one. The protocol was sanctioned by the U.S. Treasury's OFAC in 2022. Any wallet with direct exposure invites compliance review at every regulated venue. If the attacker's intent was laundering, the routing was amateurish. If the intent was signalling — a claim of independence from any jurisdiction — the routing was expensive. Either way, Blockstream's stated escalation to law enforcement, exchanges, service providers, and forensic specialists has something to bite on, which is more than most post-hack statements can honestly claim.
The bounty dispute itself is a pricing mechanism, and Blockstream chose to reject the price. Three positions have formed publicly. Samson Mow, formerly Blockstream's CSO and now running Jan3, argued that a roughly $5 billion asset base does not establish a bounty benchmark. Lorenzo Romagnoli of USDT0 took the opposite side, calling Blockstream fortunate to have recovered 85% and warning that refusing the bounty rewrites future attacker incentives. Blockstream's own position is that the actor is not a white hat.
That last framing is legally load-bearing, and it deserves more attention than it has received. A white hat discloses before extracting. This actor extracted first and negotiated afterwards. The sequence matters. By refusing the white-hat label, Blockstream keeps open the characterization of any payment as extortion rather than bounty, which preserves both its litigation posture and its ability to pursue recovery without conceding the legitimacy of the demand. Audit the logic before you trust the label — and the label here is doing real legal work, not branding work.
Meanwhile the peg mechanics remain the open item. L-BTC supply against reserve is the number that determines whether holders are whole. Without a published funding path, that number is a promise, and promises are not collateral.
The competitive read-across is easier to model than the technical one. Rootstock, Stacks, and Babylon all sit in adjacent narrative space. Their assets are smaller. Rootstock runs in the low hundreds of millions by most measures, Stacks in the low hundreds of millions to several hundred, Babylon is newer and leans entirely on BTC security assumptions. None of them is directly implicated in this failure. All of them benefit from the sentence "Liquid had a peg problem." Capital that was choosing a Bitcoin L2 on the basis of brand rather than security architecture now has a reason to re-run that evaluation, and re-running evaluations is how share migrates.
The harder read-across is structural. Every federated peg has this shape. A small signer set, a custody wallet, an issuance path, and a reconciliation assumption that is either monitored continuously or assumed to be fine. Liquid was not uniquely fragile. It was uniquely tested. The question every other federated operator should now be answering is not "could this happen to us" but "what did our last reconciliation report say, and when was it generated."
One more piece of arithmetic that the coverage has skipped. Roughly 600 BTC is a little over 0.003% of circulating supply. As a market event for bitcoin itself, this is noise — the kind of thing that gets absorbed inside a sideways tape where chop is for positioning and nothing else. As a market event for L-BTC, it is not noise at all. It is a repricing of the instrument's credit quality, and credit repricings do not resolve on price alone. They resolve on disclosure.
Contrarian: Paying Would Have Been Worse, and That Is Not a Defence
The reflex conclusion is that Blockstream should have paid and moved on. I do not think that is right, and I do not think the people saying it have priced the precedent.
Set the bounty. Now the marginal attacker's decision tree changes. Under the current outcome, the expected value of an attack is: extract everything, return 85%, receive nothing, retain legal exposure on the remainder. Under a paid-bounty regime the tree becomes: extract everything, return whatever maximizes the payout, receive a sanctioned payment, retain a smaller risk profile. The second tree trains attackers to optimize the return ratio rather than to avoid the attack. Efficiency is the only honest validator, and the efficient strategy under a bounty regime is more attacks, better calibrated.
So the refusal is defensible on incentive grounds. What is not defensible is refusing the payment without publishing the compensating framework.
That is the blind spot. The entire industry has spent two weeks arguing about whether 598.5 BTC should have been paid. Almost nobody has argued about the fact that there is no published matrix for partial returns anywhere in this sector. No tiering, no disclosure-before-extraction requirement, no defined treatment for grey-hat behaviour, no standard for how a protocol converts a recovery into a legal position. Every incident is negotiated from zero. That is not a policy. That is a series of improvisations with a security budget attached.
And there is a second blind spot underneath it. Blockstream operates a federated peg but narrates a decentralization story. Blockstream controls the signer set. Blockstream decided unilaterally whether to pay. Blockstream committed unilaterally to 1:1 coverage without publishing how. When a system's trust assumptions are concentrated, its incident response is concentrated too — which means the operator absorbs the full reputational cost of the choice. Liquidities trapped in code, not in trust. But when the code's assumptions are custodial, the trust has to be earned back in public, line by line, and that reconciliation statement has not been published.
Takeaway: What to Watch, and What the Number Actually Means
The 598.5 BTC is a test case. It is not a price signal for bitcoin, and it is not a verdict on sidechains as a category. It is the first observable instance of a federated bridge operator refusing a partial-return bounty at scale, and the market will now discover whether that choice is stable.
Three signals carry the information.
Watch the attacker's wallet. Any movement is either a negotiation restart or a laundering attempt, and both are informative. Watch L-BTC pricing on venues that quote it. A discount wider than roughly 20% means the market is pricing non-recovery regardless of Adam Back's commitment. Recovery toward par means the market believes the funding path exists even though it has not been published. Watch whether a second federated peg gets probed in the next two quarters. If it does, the refusal taught something. If it does not, the refusal taught nothing and the industry simply got lucky twice.
Red candles do not negotiate with hope, and neither do reserves. The remaining question is not whether Blockstream recovers 598.5 BTC. It is whether the next attacker returns anything at all — and that answer is being priced right now, in a market where nobody has written down the rules.