{"id":50701,"date":"2026-09-07T23:07:00","date_gmt":"2026-09-07T23:07:00","guid":{"rendered":"https:\/\/cryptomag.finance\/?p=50701"},"modified":"2026-09-07T23:07:00","modified_gmt":"2026-09-07T23:07:00","slug":"liquid-recovers-3400-btc-but-its-peg-out-gap-exposes-bridge-accounting-risk","status":"publish","type":"post","link":"https:\/\/cryptomag.finance\/?p=50701","title":{"rendered":"Liquid recovers 3,400 BTC, but its peg-out gap exposes bridge accounting risk"},"content":{"rendered":"

The Liquid Network was able to recover a significant portion of the Bitcoin (BTC) taken from its federation wallet over the weekend. However, this does not get rid of the more serious point. The problem of the event is that the peg-out can take place via the expected authorization route even if the L-BTC involved in the transaction should not have been created.<\/strong><\/p>\n

On Monday (September 7), the group responsible for the withdrawal refunded 3,400 BTC<\/a> to the federation, returning around 85% of the lost money. The transaction left them with 598.5 BTC. For consistency, all dollar conversions in this article use CoinMarketCap\u2019s Bitcoin to USD conversion<\/a> rate of $79,001.61 (which was indicated on Sept. 7).<\/p>\n

\"\"<\/figure>\n

A valid peg-out that the federation says it never authorized<\/strong><\/h3>\n

At first glance, the transaction seems routine. SideSwap claimed<\/a> that at 14:05 UTC on Sunday, a customer transmitted 4,000 L-BTC to its peg-out service. After presenting a valid SideSwap peg-out authorization, roughly 3,996 BTC was made available from the federation\u2019s wallet at 14:28:56 UTC.<\/p>\n

However, the authorization key was not stolen. Liquid reported<\/a> that SideSwap\u2019s authorization key was not used improperly. SideSwap also reported that Blockstream later determined that the reason for the event was a failure in Elements software, which enabled the generation of invalid L-BTC. Hence, the peg-out mechanism was allowing incorrect tokens to slip through, which appeared to be legitimate, even though they didn\u2019t have the backing that L-BTC was supposed to have.<\/p>\n

This makes the matter different from usual cases of key compromise and moves it into the domain of accounting problems. According to Liquid\u2019s whitepaper<\/a>, L-BTC is defined as Bitcoin that enters the sidechain with the help of a so-called two-way peg, where some BTC in the hands of a federation is used to redeem the coin. And if L-BTC is entered in an invalid way through its redemption path, the importance of the reserves\u2019 integrity equals the importance of the authorization keys themselves.<\/p>\n

The negotiation played out in Bitcoin transaction messages<\/strong><\/h3>\n

The communication between Blockstream and the actors occurred through messages that were embedded in the Bitcoin transactions. The timeline of Samson Mow indicated that the actors were urging Blockstream to fix the vulnerability<\/a> before they would return the money.<\/p>\n

Later on, Blockstream sent out a signed note saying, \u201cBridge nodes are patched<\/a>, safe to return the funds.\u201d The actors confirmed with Blockstream the final destination and returned the money amounting to 3,400 BTC back to the Liquid Federation at 16:09:25 UTC on September 7.<\/p>\n

Why the missing 598.5 BTC keeps the reserve question open<\/strong><\/h3>\n

Getting back 85% of the funds is certainly a big win, but it doesn\u2019t fix the problems for a system that relies on one-to-one backing. Approximately 598.5 BTC remains outside of the federation, representing about $47.3 million at the market price calculated in this case.<\/p>\n

According to a previous report by Cryptopolitan<\/a>, a peculiar aspect of the event was that it used the SideSwap peg-out authorization mechanism, although no breach occurred at the key level. The Bitcoin base layer was functioning properly as well. The problem lay upstream where falsely minted L-BTC was going through a redemption mechanism aimed at releasing real BTC.<\/p>\n

What the users of bridged Bitcoin should take away from this event is this: this was more than just a theft of a private key. It showed how a software problem can lead to a legitimate-seeming redemption request being made without actual reserves to back it. Even if the remaining bitcoin are returned back, the underlying issue remains: Liquid\u2019s peg-out process manages to convert actual BTC to L-BTC that never should have been considered validly collateralized.<\/p>\n

The smartest crypto minds already read our newsletter. Want in? Join them<\/a>.<\/p>","protected":false},"excerpt":{"rendered":"

The Liquid Network was able to recover a significant portion of the Bitcoin (BTC) taken from its federation wallet over the weekend. However, this does not get rid of the more serious point. The problem of the event is that the peg-out can take place via the expected authorization route even if the L-BTC involved […]<\/p>\n","protected":false},"author":1,"featured_media":50702,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_exactmetrics_skip_tracking":false,"footnotes":""},"categories":[45],"tags":[],"class_list":["post-50701","post","type-post","status-publish","format-standard","has-post-thumbnail","category-bitcoin"],"yoast_head":"\nLiquid recovers 3,400 BTC, but its peg-out gap exposes bridge accounting risk - Cryptomag<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cryptomag.finance\/?p=50701\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Liquid recovers 3,400 BTC, but its peg-out gap exposes bridge accounting risk - Cryptomag\" \/>\n<meta property=\"og:description\" content=\"The Liquid Network was able to recover a significant portion of the Bitcoin (BTC) taken from its federation wallet over the weekend. However, this does not get rid of the more serious point. The problem of the event is that the peg-out can take place via the expected authorization route even if the L-BTC involved […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cryptomag.finance\/?p=50701\" \/>\n<meta property=\"og:site_name\" content=\"Cryptomag\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-07T23:07:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cryptomag.finance\/wp-content\/uploads\/2025\/06\/generic-crypto-image.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1000\" \/>\n\t<meta property=\"og:image:height\" content=\"560\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"Crypto Magazine\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@cryptomagz\" \/>\n<meta name=\"twitter:site\" content=\"@cryptomagz\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Crypto Magazine\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=50701#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=50701\"},\"author\":{\"name\":\"Crypto Magazine\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/#\\\/schema\\\/person\\\/f749cd846c4f13ef717c12a20ce9d040\"},\"headline\":\"Liquid recovers 3,400 BTC, but its peg-out gap exposes bridge accounting risk\",\"datePublished\":\"2026-09-07T23:07:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=50701\"},\"wordCount\":619,\"image\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=50701#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/cryptomag.finance\\\/wp-content\\\/uploads\\\/Hackers-auction-Maryland-Department-of-Transportation-data-for-3.4M-BTC-g7Jz8c.webp\",\"articleSection\":[\"Bitcoin\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=50701\",\"url\":\"https:\\\/\\\/cryptomag.finance\\\/?p=50701\",\"name\":\"Liquid recovers 3,400 BTC, but its peg-out gap exposes bridge accounting risk - Cryptomag\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=50701#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=50701#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/cryptomag.finance\\\/wp-content\\\/uploads\\\/Hackers-auction-Maryland-Department-of-Transportation-data-for-3.4M-BTC-g7Jz8c.webp\",\"datePublished\":\"2026-09-07T23:07:00+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/#\\\/schema\\\/person\\\/f749cd846c4f13ef717c12a20ce9d040\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=50701#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/cryptomag.finance\\\/?p=50701\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=50701#primaryimage\",\"url\":\"https:\\\/\\\/cryptomag.finance\\\/wp-content\\\/uploads\\\/Hackers-auction-Maryland-Department-of-Transportation-data-for-3.4M-BTC-g7Jz8c.webp\",\"contentUrl\":\"https:\\\/\\\/cryptomag.finance\\\/wp-content\\\/uploads\\\/Hackers-auction-Maryland-Department-of-Transportation-data-for-3.4M-BTC-g7Jz8c.webp\",\"width\":1280,\"height\":720},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=50701#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/cryptomag.finance\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Liquid recovers 3,400 BTC, but its peg-out gap exposes bridge accounting risk\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/#website\",\"url\":\"https:\\\/\\\/cryptomag.finance\\\/\",\"name\":\"Cryptomag\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/cryptomag.finance\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/#\\\/schema\\\/person\\\/f749cd846c4f13ef717c12a20ce9d040\",\"name\":\"Crypto Magazine\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g\",\"caption\":\"Crypto Magazine\"},\"sameAs\":[\"https:\\\/\\\/cryptomag.finance\",\"https:\\\/\\\/x.com\\\/cryptomagz\"],\"url\":\"https:\\\/\\\/cryptomag.finance\\\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Liquid recovers 3,400 BTC, but its peg-out gap exposes bridge accounting risk - Cryptomag","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cryptomag.finance\/?p=50701","og_locale":"en_US","og_type":"article","og_title":"Liquid recovers 3,400 BTC, but its peg-out gap exposes bridge accounting risk - Cryptomag","og_description":"The Liquid Network was able to recover a significant portion of the Bitcoin (BTC) taken from its federation wallet over the weekend. However, this does not get rid of the more serious point. The problem of the event is that the peg-out can take place via the expected authorization route even if the L-BTC involved […]","og_url":"https:\/\/cryptomag.finance\/?p=50701","og_site_name":"Cryptomag","article_published_time":"2026-09-07T23:07:00+00:00","og_image":[{"width":1000,"height":560,"url":"https:\/\/cryptomag.finance\/wp-content\/uploads\/2025\/06\/generic-crypto-image.webp","type":"image\/webp"}],"author":"Crypto Magazine","twitter_card":"summary_large_image","twitter_creator":"@cryptomagz","twitter_site":"@cryptomagz","twitter_misc":{"Written by":"Crypto Magazine","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/cryptomag.finance\/?p=50701#article","isPartOf":{"@id":"https:\/\/cryptomag.finance\/?p=50701"},"author":{"name":"Crypto Magazine","@id":"https:\/\/cryptomag.finance\/#\/schema\/person\/f749cd846c4f13ef717c12a20ce9d040"},"headline":"Liquid recovers 3,400 BTC, but its peg-out gap exposes bridge accounting risk","datePublished":"2026-09-07T23:07:00+00:00","mainEntityOfPage":{"@id":"https:\/\/cryptomag.finance\/?p=50701"},"wordCount":619,"image":{"@id":"https:\/\/cryptomag.finance\/?p=50701#primaryimage"},"thumbnailUrl":"https:\/\/cryptomag.finance\/wp-content\/uploads\/Hackers-auction-Maryland-Department-of-Transportation-data-for-3.4M-BTC-g7Jz8c.webp","articleSection":["Bitcoin"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/cryptomag.finance\/?p=50701","url":"https:\/\/cryptomag.finance\/?p=50701","name":"Liquid recovers 3,400 BTC, but its peg-out gap exposes bridge accounting risk - Cryptomag","isPartOf":{"@id":"https:\/\/cryptomag.finance\/#website"},"primaryImageOfPage":{"@id":"https:\/\/cryptomag.finance\/?p=50701#primaryimage"},"image":{"@id":"https:\/\/cryptomag.finance\/?p=50701#primaryimage"},"thumbnailUrl":"https:\/\/cryptomag.finance\/wp-content\/uploads\/Hackers-auction-Maryland-Department-of-Transportation-data-for-3.4M-BTC-g7Jz8c.webp","datePublished":"2026-09-07T23:07:00+00:00","author":{"@id":"https:\/\/cryptomag.finance\/#\/schema\/person\/f749cd846c4f13ef717c12a20ce9d040"},"breadcrumb":{"@id":"https:\/\/cryptomag.finance\/?p=50701#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cryptomag.finance\/?p=50701"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptomag.finance\/?p=50701#primaryimage","url":"https:\/\/cryptomag.finance\/wp-content\/uploads\/Hackers-auction-Maryland-Department-of-Transportation-data-for-3.4M-BTC-g7Jz8c.webp","contentUrl":"https:\/\/cryptomag.finance\/wp-content\/uploads\/Hackers-auction-Maryland-Department-of-Transportation-data-for-3.4M-BTC-g7Jz8c.webp","width":1280,"height":720},{"@type":"BreadcrumbList","@id":"https:\/\/cryptomag.finance\/?p=50701#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cryptomag.finance\/"},{"@type":"ListItem","position":2,"name":"Liquid recovers 3,400 BTC, but its peg-out gap exposes bridge accounting risk"}]},{"@type":"WebSite","@id":"https:\/\/cryptomag.finance\/#website","url":"https:\/\/cryptomag.finance\/","name":"Cryptomag","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cryptomag.finance\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/cryptomag.finance\/#\/schema\/person\/f749cd846c4f13ef717c12a20ce9d040","name":"Crypto Magazine","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g","caption":"Crypto Magazine"},"sameAs":["https:\/\/cryptomag.finance","https:\/\/x.com\/cryptomagz"],"url":"https:\/\/cryptomag.finance\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/posts\/50701","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=50701"}],"version-history":[{"count":0,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/posts\/50701\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/media\/50702"}],"wp:attachment":[{"href":"https:\/\/cryptomag.finance\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=50701"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=50701"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=50701"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}