Blockstream has not said whether its 11-of-15 federation was bypassed or complied. Until someone publishes what share of Liquid's reserves left on September 6, an L-BTC balance is an unverified claim.
Perspective Coverage
7 publishers
- Builder
- Builder 30%
- Operator
- Operator 40%
- Investor
- Investor 30%
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+25
- Incentives60
- Confidence58
The attackers who drained 4,000 BTC from Liquid handed back 3,400 after the patch and kept 598.5. Blockstream puts about $47 million on that hold and says it will trace the coins instead of paying.
Perspective Coverage
7 publishers
- Builder
- Builder 24%
- Operator
- Operator 43%
- Investor
- Investor 33%
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap+10
- Incentives62
- Confidence68
Unnamed Base vault loses $6 million to a whitelist flaw spotted a week earlier
About $6 million in wstETH left an unidentified Base vault via a whitelist flaw a researcher had found the week before, Immunefi says. Roughly $31.7 million remains under seven unnamed Safe signers who, more than a day later, had not claimed the vault or announced a fix.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+15
- Incentives70
- Confidence40
Bitget's wallet breach accounts for about four-fifths of September's crypto theft after returns
Bitget lost about $387.5 million to forged withdrawals from its wallet system, more than half of September's $742 million in crypto thefts. Most of Liquid Network's loss was handed back, so what stayed stolen sits mainly with one exchange's withdrawal infrastructure.
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap+8
- Incentives
- Not scored
- Confidence55
Blockstream paused the Liquid bridge after roughly 4,000 BTC left the federation wallet, and the people holding it will send most of it back only once the flaw is fixed, which puts the patch timetable in their hands.
Perspective Coverage
7 publishers
- Builder
- Builder 26%
- Operator
- Operator 41%
- Investor
- Investor 33%
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap+15
- Incentives55
- Confidence70
One Bitget breach supplied half of September's record $766 million in crypto hack losses
Crypto hacks drained $766.49 million in September, a 2026 monthly record, and $387.5 million came from one breach of Bitget's hot wallets. After the money returned from the Liquid Network exploit, that one exchange accounts for about 80% of what stayed stolen.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence50
Coldcard owners who held their own keys lost over $100 million to a firmware bug
Coinkite's Coldcard firmware skipped its hardware random number generator, letting attackers brute-force seeds and drain over $100 million in bitcoin. Liquid's later $320 million drain adds node software to the code a bitcoin holder has to trust.
Reality
- Evidence38
- Adoption
- Not scored
- Hype gap+30
- Incentives
- Not scored
- Confidence42
Blockstream says none of the 15 federation keys were compromised, which is what makes the $320m peg-out worth studying: honest signers running buggy validation code approved it, and the reserve is still short.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+12
- Incentives45
- Confidence58
Blockstream pauses Liquid after $320 million exploit, tries to reach hackers onchain
The withdrawal cleared every control the Liquid Federation actually operates, which is why an 11-of-15 quorum released the bitcoin in 23 minutes. Recovery now depends on whoever holds the coins answering an email address.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+20
- Incentives55
- Confidence55
The 11-of-15 federation multisig held and no key was stolen; the node software that tells signers whether a peg-out is backed carried a week-old bug, and about $320m walked out of Blockstream's sidechain.
Perspective Coverage
5 publishers
- Builder
- Builder 27%
- Operator
- Operator 39%
- Investor
- Investor 34%
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+15
- Incentives55
- Confidence60
Swiss Bitcoin Pay pulled its whole server fleet offline over five fields of customer data
The payment firm says its servers went dark on September 14 after an intruder probably reached internal systems, and that customer emails, IBANs, transaction histories and hashed passwords may have been exposed.
Reality
- Evidence34
- Adoption38
- Hype gap+18
- Incentives68
- Confidence45
Symbiosis's attacker turned 2^62 fake syBTC into 4.39 real WBTC
Symbiosis halted BTC routing on September 11 after its BridgeV2 processed a bad message and generated more than 2^62 unbacked syBTC. The attacker realized about $336,000, roughly 1.5 times the average hack TRM counted this year.
Reality
- Evidence40
- Adoption18
- Hype gap+22
- Incentives55
- Confidence38
The attacker's self-set 15% leaves Liquid's peg wallet about 600 BTC short
SlowMist says a cache key collision in Blockstream's Elements let an attacker mint 3,998.5 L-BTC and peg them out for real Bitcoin. About 3,400 BTC came back after the patch, leaving the pool near 3,597.
Reality
- Evidence58
- Adoption72
- Hype gap+20
- Incentives65
- Confidence55
A node bug made Liquid's 11-of-15 multisig pay out on coins that never existed
Blockstream's federation signers behaved correctly and still released roughly 4,000 bitcoin, because the software that decides what counts as a real L-BTC is a different system from the keys guarding the peg.
Reality
- Evidence58
- Adoption45
- Hype gap+12
- Incentives66
- Confidence55
Liquid's $320M peg-out ran on an authorization key reported unbreached
Some 3,996 BTC left the Liquid Federation on Sunday through the one control designed to stop exactly that, which makes the open question where in the path the authorization came from, not whether the takers are honest.
Reality
- Evidence52
- Adoption45
- Hype gap+8
- Incentives65
- Confidence48
Bitcoin's first post-quantum signature BIP arrives with its tradeoffs already conceded
Blockstream's SHRINCS is the first post-quantum signature scheme written to Bitcoin's block economics, and Jonas Nick says up front it is not optimal. The argument now is about price.
Reality
- Evidence55
- Adoption22
- Hype gap+12
- Incentives68
- Confidence48
Bitcoin's cross-layer plumbing had one supplier, and the stand-in is still invite-only
Blockstream opened a beta of its atomic swap service a week after Boltz went dark. General availability has no date, and wallet teams are the ones carrying that gap.
Reality
- Evidence44
- Adoption19
- Hype gap+27
- Incentives68
- Confidence52