Blockstream bug exposes sidechain federation flaws

A software caching shortcut wiped out an entire Bitcoin sidechain vault in seconds.

On The Jack Mallers Show, host Jack Mallers detailed how an update in Blockstream’s Liquid Network accidentally generated identical cache signatures for two different transaction formats. Checking cryptographic range proofs requires heavy computational power, so developers implemented caching to speed up node verification. The attacker primed node memory with a valid transaction and immediately followed with a submission containing a massive negative value. Nodes recognized the cached signature and skipped the range check. That flaw allowed the attacker to mint 4,000 liquid tokens out of thin air.

"A smart contract bug didn't break Bitcoin. It broke Liquid."

- Jack Mallers, The Jack Mallers Show

The fake tokens were immediately redeemed for real collateral. On Ungovernable Misfits, hosts q and a explained that SideSwap accepted the forged assets and routed them through the standard peg-out mechanism. Eleven federation signers authorized the withdrawal because their node software relied on the faulty consensus view. The attacker siphoned nearly 4,000 real Bitcoin. Only 200 coins remained in the reserve vault.

A few days later on Presidio Bitcoin Jam, analysts noted that the attacker returned 3,400 Bitcoin after Blockstream patched its bridge nodes. However, the hacker retained roughly 600 Bitcoin - worth nearly $50 million - as an unnegotiated fee. On Stacker News Live, host Keon rejected the whitehat label for the attacker. Extortion remains extortion when funds are kept against an owner's consent. Encrypted negotiations between Blockstream and the attacker broke down after the thief threatened to leak unencrypted logs on-chain.

On Bitcoin & Economic News, analyst David Bennett warned that AI vulnerability scanners have transformed protocol security. Automated tools scan open-source repositories continuously and construct exploits faster than developers can deploy fixes. Public code records show a pull request patching the Liquid caching bug sat open for weeks before the exploit occurred. None of the 15 federation operators audited the code independently. They blindly pushed the software update to their nodes.

"Automated tools now scan code repositories continuously to construct exploits faster than human auditors can identify flaws."

- David Bennett, Bitcoin & Economic News

The aftermath raised broader questions about open-source maintenance and regulation. On Stacker News Live, Keon argued that new European Union rules like the Cyber Resilience Act threaten open-source development by forcing mandatory 72-hour bug reporting windows. Such bureaucratic mandates penalize small developer teams without preventing exploits. Software resilience relies on continuous code audits rather than government reporting forms.

Synthetic Bitcoin layers promise speed and privacy, but they inherit human error. Self-custody base-layer Bitcoin remains unaffected.