Key Takeaways
- Bitcoin Red Team claimed it warned Blockstream before the hack, fueling debate over preventable losses.
- Blockstream denied ignoring security warnings, attributing the vulnerability to a flawed AI bug fix.
- Liquid restored transactions on Sept 10, but peg-outs remain disabled with nearly 600 BTC still missing.
Bitcoin Red Team Allegedly Reported Liquid Bug Before 4,000 BTC Incident
While the fight to recover the nearly 600 BTC remaining from the Liquid exploit incident continues, a group of security developers pointed out that this theft might have been avoided in the first place.
The Bitcoin Red Team, a group of volunteers dedicated to auditing and disclosing vulnerabilities across bitcoin-aligned projects that surged after the Coldcard exploit, indirectly signaled that it had already disclosed the vulnerability exploited to move close to 4,000 BTC from the Liquid federation wallets.
Answering a post by Blockstream founder and CEO Adam Back, who explained that the bug that allowed the hack to happen was introduced “due to an incorrect bug fix, to an AI-found bug which was also a non-critical bug,” Bitcoin Red Team co-lead Calle stated:
“Turns out it only costs you 600 BTC to ignore an email from the red team.”
Calle continued, stating that Back’s statements were inaccurate and that Blockstream had only “selectively and inaccurately mentioned the patches without complete and very clear history of acknowledgement.”
Nonetheless, former Blockstream CSO Samson Mow stressed that no emails were ignored, declaring these insinuations diminished the Red Team’s professionalism.
“We will give Blockstream time to restore orderly operations and publish a postmortem on the liquid hack before we share our own complete account of the disclosure process,” Calle concluded, hinting at conflicting versions of the same events leading to the hack.
While the sidechain network had been detained since the incident was disclosed, on September 10, Liquid restarted block production without enabling transactions. At the time of writing, transactions have been enabled, and nodes are validating blocks. Nonetheless, peg-outs remain disabled “as a precautionary measure,” offering no defined timeframe for their resumption.
The white-hat hacker still controls the remaining BTC, meaning a third party would have to deposit the needed assets to ensure a 1:1 peg between BTC and L-BTC, the native liquid asset.
