Writing · September 2026

Every signature was legitimate.

There's a habit on a job site that saves more money than any tool you'll ever buy: check the tape, not just the mark. Two carpenters measuring the same board with the same bad tape will agree with each other perfectly, twice, and cut it wrong both times. Agreement isn't accuracy. It only feels like it.

On September 6, fifteen machines agreed with each other and about $320 million in bitcoin walked off a sidechain.

At 14:05 UTC, someone sent 4,000 Liquid Bitcoin to SideSwap's peg-out service — the ordinary way you turn L-BTC back into bitcoin on the main chain. Twenty-three minutes later the Liquid Federation paid out roughly 3,996 BTC, leaving about 197 behind in a wallet that had held around 4,200. Liquid halted the network. Exchanges froze L-BTC withdrawals.

Then the part that should stop you cold: nothing was stolen, in the sense we normally use the word. Liquid and SideSwap both confirmed the peg-out authorization key was not compromised, and neither was any other. Every signature on the withdrawal was legitimate.

Liquid's peg is held by a federation running an 11-of-15 multisig, and the hardware security modules that sign peg-outs did their jobs exactly as specified. They checked that the withdrawal went to a whitelisted address. They checked that it matched the amount of L-BTC burned. Both were true. What none of them checked — because it was never their job — is whether the L-BTC being burned should have existed at all.

Where redundancy stops being redundant

Eleven of fifteen is real protection against eleven operators going bad. It is no protection at all when all fifteen run the same validation code and the code is wrong. Redundant signers are not redundant checks. They are one check, executed fifteen times.

The number of signers tells you how hard it is to corrupt the humans. It tells you nothing about how hard it is for all of them to be wrong in unison.

I wrote node guides for years, and this is the misunderstanding I corrected most often. People counted validators and felt safe.

Nobody can tell you exactly what happened yet

Here I have to be straight about the limits of what's known, because some of the coverage isn't. Blockstream has said the cause was a software bug in Elements, the codebase underneath Liquid, rather than compromised keys. Past that, the accounts diverge.

The most detailed public explanation comes from the developer Calle, amplified by Ledger CTO Charles Guillemet. Liquid hides transaction amounts by default using confidential transactions, and their validity is checked with cryptographic range proofs. Those proofs are expensive, so nodes cache the results — and the cache key was bound too loosely, accounting for neither the asset commitment nor the output script. Craft a collision, and an invalid output inherits a valid proof's verdict. On that account, roughly 3,996 L-BTC were created with nothing behind them. Calle cautioned that his description is simplified and may contain errors, and Blockstream has not confirmed it.

Others read it differently, putting the flaw in the peg-out authorization logic sitting above the multisig rather than in any minting. Two proposed mechanisms, one confirmed outcome. I'm not going to pretend to settle it for you.

But notice why it's hard to settle. On Liquid, amounts are confidential. If unbacked coins were created, they were invisible as coins; the only place a discrepancy could surface was the moment somebody converted them into real bitcoin. A chain that hides its amounts cannot be independently audited for its own supply. You cannot add it up yourself. You are trusting that the code checking the proofs is correct — which is precisely the thing in question.

On Bitcoin's main chain you can sum the UTXO set on your own machine and satisfy yourself that 21 million means 21 million. That is not a luxury feature. It's the whole proposition.

What I'd take from this

A pegged asset is an IOU. L-BTC, wrapped anything, bridged anything — what you hold is a claim, and it is worth what the redemption mechanism is worth on the day you use it. The signers were honest here and it didn't matter.

Ask what backs it, and whether you can check. Before holding a pegged asset, find out where the reserve sits, whether the address is public, and whether the circulating supply of the wrapper can be checked against it by anyone who cares to look. If the answer is "trust the operators' code," that isn't automatically disqualifying — but it is the actual risk, and it deserves to be sized like one.

Don't hold the wrapper longer than you need the wrapper. Peg in for the thing you're doing, peg out when you're done. Convenience assets are for using, not for storing.

One more thing, on the people holding the coins. They left an on-chain message saying they are white hats and would return the funds once the bug was patched, and Blockstream said on September 7 that the bridge nodes were patched and secured. Guillemet's objection is the right one: responsible disclosure means telling the developers before you move a reserve, not after. Whatever comes back, that was other people's money for a day.

Fifteen honest signers. Every signature valid. The money left anyway.

Verify everything — especially the number everybody already agrees on.

— Jon Tetreault, September 2026. The habits, tools, and checks behind this piece are what I teach in Crypto Security Mastery.