Software Flaw Let Attackers Withdraw Nearly 4,000 BTC from Liquid

On Sept. 6 nearly 4,000 Bitcoin were withdrawn from Liquid’s shared reserve after the network processed redemptions for L-BTC tokens that had not been backed by deposits. The private keys used to sign the outgoing transactions were not taken during the incident. Attackers created unbacked L-BTC on Liquid’s token chain and exchanged those tokens for coins from the reserve.

Liquid issues L-BTC tokens that are intended to represent Bitcoin held in a shared reserve: users deposit Bitcoin into the reserve and receive L-BTC, and when those tokens are redeemed matching coins are released from the reserve. An industry reconstruction found that software tracking which L-BTC tokens were backed accepted tokens that should not have existed, and the system approving redemptions treated those tokens as valid.

Because operators approving withdrawals relied on the software’s report of backed balances, the network signed and processed withdrawals based on incorrect information. The ledger of tokens and the ledger of reserve Bitcoin diverged when the token ledger contained entries for L-BTC without corresponding deposits.

Blockchain analysis shows some of the missing coins were returned: about 3,400 BTC were moved back into the reserve on Sept. 7. On Sept. 12 an infrastructure provider declined a demand for a bounty. The public transaction record documents the movements of coins but does not determine which parties are contractually required to cover any remaining shortfall.

Private insurance and contractual obligations affect how losses are resolved. Many custody and exchange firms carry private insurance that covers specific types of theft or infrastructure failures, but policies differ in scope and in whom they protect. Insurers typically contract with the business named on the policy, not individual customers. Some disclosures note that policies may cover only a portion of stored assets and may exclude losses caused by compromised individual login credentials.

A second category of cover is technology errors and omissions insurance, which can pay for legal defense and settlements when a vendor’s product causes damage. Such policies do not necessarily replace customer assets directly; a firm seeking recovery may file claims under its own policies or pursue claims against a software vendor’s liability coverage.

Contracts governing compensation can define repayment as a fixed dollar amount or as replacement in the original cryptocurrency. If compensation is set in dollars, price changes between the loss and any payout can change how many coins a customer can buy with the settlement. If coins are later recovered, agreements must specify how returned assets are allocated among holders. The sequence of insurer reviews, claims between firms, and any legal action can extend the time before customers see reimbursement.

Public filings and customer terms show firms make different commitments about reimbursement and the form it may take. The transaction record and public disclosures provide facts about coin movements and policies, while legal or contractual responsibility for any remaining deficit depends on the agreements among the reserve operator, software providers, insurers and customers.