Liquid Is Paused After a 4,000 BTC Peg-Out. The Coins Have Not Moved Back.
The Liquid Federation's reserve address paid 3,996 BTC to a customer address at 14:28 UTC on September 6 after a 4,000 L-BTC order passed through SideSwap's peg-out service with valid federation signatures; Liquid and SideSwap attribute the L-BTC to a bug in the Elements software and say no key was compromised. The recipient, self-described on-chain as "whitehats", proposed returning "most" of the coins and then, at 03:30 UTC on September 7, told Blockstream to "fix the bug first" and patch every node before any transfer back; Blockstream answered with a message signed by its published security key. As of 09:55 UTC the recipient address still holds 3,998.5 BTC, the federation address holds 197.5 BTC, the sidechain is paused, and Blockstream has published no patch or post-mortem. Correction, September 7: at publication this Wire omitted a message Blockstream had signed on-chain at 09:41 UTC, "Bridge nodes are patched, safe to return the funds." SG's pre-publication check missed it. The public-release statement above was accurate; the state of the exchange was not complete.
Primary record: mempool.space