Jack Mallers warns Liquid bug exposes sidechain limits
- A caching bug in Blockstream's Liquid network allowed a hacker to mint 4,000 unbacked Bitcoin.
- The attacker returned 3,400 Bitcoin but kept 600 coins as an extortionate finder's fee.
- Federated multisig security failed because all fifteen nodes ran un-audited software updates without independent checks.
A flawed caching shortcut wiped out Liquid's security guarantees.
Jack Mallers explained on The Jack Mallers Show that a smart contract bug inside node memory allowed an attacker to mint 4,000 unbacked LBTC. Liquid uses range proofs to prevent users from introducing negative balances into transaction ledgers. To save processing power, node software cached valid proof signatures. A recent patch accidentally generated identical cache keys for distinct transaction formats, allowing the attacker to bypass range checks with a massive negative number and clear the vault.
"A smart contract bug didn't break Bitcoin. It broke Liquid."
- Jack Mallers, The Jack Mallers Show
On Ungovernable Misfits, hosts q and a detailed how eleven federation signers authorized the withdrawal through SideSwap because their nodes relied on the faulty software. The attacker withdrew 4,000 real Bitcoin, leaving barely 200 coins in the entire network vault. Independent analyst Orange Surf noted that a pull request patching the caching logic sat open since early September, but nodes failed to merge it before the breach occurred.
What followed was a tense on-chain standoff. The hacker returned 3,400 Bitcoin but kept roughly 600 BTC - worth nearly $50 million - claiming it as a self-awarded whitehat bounty. Negotiations collapsed after Blockstream demanded full recovery under threat of legal action, prompting the attacker to send a single sad-face emoji on-chain before walking away.
On Stacker News Live, host Keon rejected the hacker's self-proclaimed whitehat label, arguing that keeping stolen funds against an owner's consent is outright extortion. Keon warned that hot multi-sig federations carry severe operational risks when operators blindly trust software updates. Even as the attacker attempts to wash funds through CoinJoin mixers and cross-chain bridges, permanent ledger tracking leaves little room for a clean escape.
"Withholding stolen funds involuntarily turns a whitehat security researcher into an extortionist."
- Keon, Stacker News Live
On Bitcoin And, host David Bennett observed that AI-driven vulnerability scanners are drastically altering protocol security. Automated tools now scan public repositories and generate exploits faster than human engineering teams can audit and merge fixes. When all fifteen federation members run identical un-audited updates, federated multi-sig custody offers no more safety than a single central server.
Blind trust in sidechain code carries a heavy price.