Liquid sidechain hack exposes federated security flaws

A single transaction erased the illusion of sidechain security.

A hacker exploited a faulty software patch in Blockstream’s Liquid sidechain to drain 4,000 Bitcoin - worth roughly $320 million - out of thin air. As reported on Presidio Bitcoin Jam, the vulnerability originated from a consensus update intended to fix a previous flaw. The attacker inflated their tokenized account balance and siphoned the payout through SideSwap, a federated operator that lacked basic withdrawal limits and identity verification.

The attacker returned 3,400 Bitcoin but kept roughly 600 coins - worth near $50 million - as a self-assigned finder's fee. On Bitcoin And, host David Bennett detailed how on-chain negotiations turned tense over PGP-encrypted payloads before the hacker abruptly ended the conversation with a sad-face emoji. On Stacker News Live, host Keon rejected the hacker's self-proclaimed status as a white hat, maintaining that holding stolen collateral hostage constitutes outright extortion.

"Keeping $50 million against the owner's consent is extortion, regardless of how polite the blockchain messages were."

- Presidio Bitcoin Jam

The breach exposed deep structural vulnerabilities in federated Bitcoin architecture. Liquid relies on an 11-of-15 multisig federation to secure network collateral. Yet all 15 member entities deployed Blockstream’s compromised update without running independent code audits. On Ungovernable Misfits, co-host Max argued that Blockstream was fortunate to recover any funds at all, emphasizing that unpatched flaws expose widespread maintenance failures within institutional infrastructure.

The attack highlights a dangerous new paradigm in open-source protocol defense. On Bitcoin And, Bennett explained that AI-driven scanning tools now continuously audit public code repositories, enabling bad actors to build functional exploits faster than human security teams can deploy patches. Open-source projects operating without continuous automated auditing face persistent breach attempts.

"Automated tools now scan code repositories continuously to construct exploits faster than human auditors can identify flaws."

- David Bennett, Bitcoin And

Moving the stolen loot presents its own hurdles. On Stacker News Live, Keon noted that while attackers attempt to mix funds through ThorChain bridges and Ethereum pools, permanent ledger visibility makes long-term liquidation nearly impossible. Meanwhile, surrounding infrastructure remains vulnerable; co-host Q pointed out on Ungovernable Misfits that software supply chain failures - from compromised email platforms to node management flaws in Alby Hub - undermine hardware and key security across the ecosystem.

Multisig federations cannot replace true cryptographic consensus. When code cracks, federated trust crumbles.