SECURITY ALERT

The exit has reopened. The front door has not.

The Liquid Federation, which runs the Bitcoin sidechain Liquid, said on Tuesday it has restored semi-automated BTC-LBTC swaps through participating swap providers, while direct peg-outs from its bitcoin reserve stay restricted six weeks after an exploit, according to a recovery update on the Liquid blog.

About 602 BTC taken in that exploit is still outstanding, Blockstream said in its 23 Sep incident assessment.

That is roughly $49.1 million at Kraken’s price of $81,598 as of 13:42 UTC.

What changed on Tuesday

The federation said updated software that manages the network’s bitcoin reserves has been deployed, and that enough of its functionaries, the operators who co-sign blocks and peg-outs, are now running it.

Swaps are enabled “without protocol-imposed volume limits”, the federation wrote.

For most users of supported swap providers, it said, this restores a practical way to turn LBTC back into bitcoin “even while direct Federation peg-outs remain restricted.”

Liquid’s post on X at 12:49 UTC said normal peg and balance validation “will be reinstated soon.” Blockstream shared the update at 13:30 UTC.

The federation did not name the swap providers or give a date for peg-outs.

So what still has to happen before the front door opens?

The last step

Peg-outs return only after the network’s full 1:1 bitcoin backing is re-established, the federation said, followed by a controlled restart for holders of peg-out authorization keys (PAKs).

It also plans to let anyone monitor the reserve through block explorers.

The update does not say how the 602 BTC gap will be closed.

How did the gap open in the first place?

The timeline, in UTC

  • 6 Sep, 13:53. An attacker uses a bug in the rangeproof verification cache of Elements, Liquid’s software, to mint about 4,000 LBTC with nothing behind it, Blockstream says.
  • 6 Sep, shortly after. The unbacked LBTC goes out through the standard peg-out process via SideSwap, a federation member holding a PAK, as a withdrawal of about 4,000 BTC. With smaller peg-outs, the reserve falls from about 4,205 BTC to 197 BTC.
  • 7 Sep, 16:09. The attacker, who had identified themselves on-chain, returns 3,400 BTC after negotiations.
  • Within days. Blockstream ships the hardening release Elements v23.3.4.

Chainalysis valued the drain at about $320 million at the time.

No key was stolen. The software accepted a transaction it should have rejected.

Other Liquid assets, including USDt, were not hit by the bug, Blockstream said, but users could not move them during the halt.

What LBTC holders can do now

  • Check the rate and fees a swap provider quotes against 1:1 before converting. A swap is a trade with that provider, not a federation peg-out.
  • Use only providers and links from Liquid’s official channels. Anyone offering a “priority peg-out” by direct message is not the federation.
  • If you can wait, the federation says peg-outs will return once full backing is restored. It has not said when.

For background on who holds the keys in a federated setup, see what a crypto custodian does. Another weak-software failure this week is in SlowMist’s Qubic wallet analysis.

Six weeks on, the reserve is short and the price of patience is still unknown. Who fills the gap?

Corrections and new evidence: [email protected]

This article is for information only and is not investment advice.