Book a call with SOUND HSA to add bitcoin health savings accounts for your team
Book A Call Today
If you’re ready to sign up now, use code TBL for $50 off at sign-up
Yet another week of exploited vulnerabilities within the bitcoin ecosystem. This time the victim was ‘Liquid’, the layer-2 or sidechain built and maintained by Blockstream. And yet the price of bitcoin barely flinched, just like after the Coldcard exploit.
Before we dive into the market analysis, first a few points around that exploit. 4,000 bitcoin were stolen from Liquid’s federation wallet. The ‘white hat hackers’ used OP_RETURN and on-chain transactions to communicate with Blockstream, while the whole world could follow what was said during these ‘negotiations’, which is pretty wild. Normies can’t even comprehend what is happening here.
The hackers promised to return ‘most’ of the bitcoin once Blockstream fixed the bug. After the fix was deployed, the hackers returned 3,400 bitcoin and kept the remaining 600. It’s not clear whether they intend to keep those 600 bitcoin or return them once Blockstream and the hackers agree on a fair ‘bug bounty’.
Without going into too much detail, it is important to understand that the bitcoin protocol itself wasn’t ‘hacked’ or exploited. Liquid keeps its bitcoin in an 11-of-15 multisignature wallet. There are 15 functionaries that each hold a key in specialized hardware (HSMs). No keys were lost or leaked. But because the issuance and redemption of Liquid Bitcoin, or L-BTC, is automated, the hackers found a bug that convinced at least 11 functionaries that they held 4,000 L-BTC and wanted to redeem those for 4,000 ‘real’ bitcoin. And it worked, so the functionaries signed a valid bitcoin transaction that sent almost the entire content of the vault to the hackers.
Compare it with a physical vault that contains 4,000 gold bars (layer 1, real gold), against which an institution or federation issued 4,000 certificates of 1 bar of gold each (layer 2, IOUs). The certificates have been sold and distributed over thousands of holders, but those certificates weren’t hacked or stolen in this case. The ‘thieves’ convinced the employees of the vault where the gold is stored that they held 4,000 certificates and swapped those for the real bars. The employees handed over the gold bars, and only in hindsight did they realize the bank robbers never had the ‘real’ certificates in the first place.
So the people holding L-BTC have a token that should represent a 1:1 peg to BTC, but with the vault drained, the L-BTC was worthless. Now that 85% has been returned, one could say that one L-BTC is currently worth 85% of a BTC. Hopefully Blockstream finds a way, or a compensation high enough, to convince the hackers to return the rest of the bitcoin and make L-BTC holders whole again.
We’ve recorded a new monthly video with Pascal Hügli from Less Noise More Signal, where we also talked about this Liquid hack, AI, macro and bitcoin.
This letter is called ‘The Great Hardening’, because in a couple of years we might look back on this period as the time when companies and countless projects like BTCPay Server had to focus on hardening their software instead of building new features. AI made the search for exploits so cheap that hackers are screening every repository and every possibility they can find for bugs to exploit.
