@phpeterle Blog This weekend the Liquid Network, the Bitcoin sidechain run by Blockstream, lost about 4,000 BTC in a single transaction. That was nearly everything the federation held in reserve, somewhere around 320 million dollars. A day later, 3,400 BTC came back. The other 598.5 stayed with whoever took them, who introduced themselves from the very first message as “good-guy hackers”.
The bug itself is interesting, and I’ll explain what’s known about it. But what made me write this post was the ratio. Someone holding 4,000 BTC who gives back 85% isn’t doing financial math. They’re doing moral math, and that math behaves in a predictable way that behavioral economics has been studying for a long time. It’s the same logic as finding a wallet on the street and, instead of taking all of it, taking only part.
What Liquid is
Liquid is a federated sidechain. You send bitcoin to an address controlled by the federation (peg-in), and the same amount shows up as L-BTC on Liquid. To get out, you go the other way (peg-out): you burn L-BTC on the sidechain and the federation releases the matching BTC on the main network. The federation is a group of exchanges, companies and operators running nodes called functionaries, and the bitcoins sit in a multisig shared among them.
The trade Liquid offers goes like this: you give up some of Bitcoin’s decentralization (the federation could, in theory, collude) in exchange for one-minute blocks, fast settlement between exchanges, and confidential transactions, where the amount transferred is hidden on the blockchain. That last point matters for this story.
flowchart LR BTC["Bitcoin<br/>(mainnet)"] Fed["Federation<br/>(multisig)"] LQ["Liquid<br/>(L-BTC)"] BTC -->|"peg-in: BTC goes into the multisig"| Fed Fed -->|"L-BTC issued 1:1"| LQ LQ -->|"peg-out: L-BTC is burned"| Fed Fed -->|"BTC leaves the multisig"| BTC
The software that runs Liquid is Elements, a fork of Bitcoin Core maintained by Blockstream with these extra features. And the whole guarantee of the system comes down to one equality: the amount of L-BTC in circulation can never exceed the amount of BTC the federation holds. As long as that holds, every L-BTC is backed. When it breaks, someone can withdraw bitcoin they never deposited.
The attack
From what’s been disclosed so far, that’s exactly the equality that broke, and the path went through confidentiality.
In a confidential transaction, the amount doesn’t appear in plain text. It’s hidden inside a cryptographic commitment, and for the network to accept the transaction the sender has to attach a range proof: proof that the hidden amount falls within a valid range and that inputs match outputs, without revealing the numbers. Verifying range proofs is expensive, so Elements keeps a cache of the results.
The bug was in that cache. Under a certain condition it reported a proof as valid without the proof ever having been validated, and that made it possible to build a transaction that created L-BTC out of nothing. No key was compromised, no functionary was breached. The federation did exactly what it was supposed to do: it saw seemingly valid L-BTC being burned in a peg-out and released the matching BTC.
The peg-out went through SideSwap, a service on the network that makes it easier to exit to mainnet. SideSwap later confirmed that the L-BTC came from an Elements bug, not from a flaw in its own systems. On Sunday, September 6, about 4,000 of the roughly 4,200 BTC in reserve left in a single operation. Blockstream paused the network and shut down the bridge nodes, and exchanges suspended L-BTC deposits and withdrawals.
You detect key theft through an improper signature. Unbacked issuance passes every legitimate signature, because the federation wasn’t fooled about who was asking, it was fooled about how much existed. It’s an accounting bug, and accounting bugs don’t trip any security alarm.
Negotiating over OP_RETURN
Whoever took the money didn’t run. In the same window a message showed up on the Bitcoin blockchain in an OP_RETURN, a transaction’s free-form data field: “we are whitehats. contact us on chain”.
From then on the conversation happened in public, block by block, some of it in plain text, some encrypted with PGP. Pieced together from the sources:
| When | Who | Message |
|---|---|---|
| Sun, Sep 6 | Attackers | ”we are whitehats. contact us on chain” |
| Block 965,822 | Blockstream | Asked for contact through the security email |
| Block 965,875 | Attackers | ”Please fix the bug first. The chain is under risk at latest commit right now” |
| Mon, Sep 7 | Attackers | Asked whether returning “most” to the federation address would work |
| Mon, Sep 7 | Blockstream | ”Yes, thank you” |
| Mon, Sep 7 | Blockstream | PGP-signed: “Bridge nodes are patched, safe to return the funds” |
| Block 965,950 | Attackers | 3,400 BTC returned to the federation’s peg address |
| Later | Attackers | 🙁 |
The remaining 598.5 BTC, about 47 million dollars, stayed at the source address. The last message was a sad emoji, which suggests the conversation about the size of the “reward” didn’t end where they wanted.
Notice the “most”. The question wasn’t “can we give it back?”, it was “can we give most of it back?”, and Blockstream answered “yes, thank you” to that question. That’s the closest this story got to a bounty agreement.
Good-guy hacker
A good-guy hacker, or white hat, is a term with a fairly settled meaning: someone who finds a vulnerability and reports it to whoever can fix it, without exploiting it for personal gain. Many projects formalize this with bounty programs, where the company decides up front how much it pays per bug and what the cap is.
What happened at Liquid flips the order. First 320 million was withdrawn, then the bug was reported, and the size of the reward was set unilaterally by whoever had the money. Ledger’s CTO, Charles Guillemet, pointed out exactly that: taking first and negotiating later isn’t what the word describes, though he later admitted they might be inexperienced researchers. Blockstream itself, in its statement, called them “purported white-hat hackers”.
There’s precedent on both sides. In 2021 Poly Network lost more than 600 million dollars to an attacker who returned all of it, and the company offered a 500 thousand dollar reward on its own. There are also cases where the project agreed to let the attacker keep a fraction as the cost of recovering the rest. Liquid’s 15% falls into that second category, with one detail: nobody offered it, they took it.
You could argue about the label all day. I find it more interesting to ask why they gave it back.
The wallet on the street
Imagine you find a wallet on the street with a thousand reais and some IDs in it. There are three possible behaviors: return everything, keep everything, or keep part and return the rest.
The third looks the most irrational. If you’ve already decided to keep money that isn’t yours, the moral cost is already paid, and the practical cost of taking 200 is the same as taking 1,000. Even so, it’s what most people do when they’re observed in an experiment. Almost nobody steals everything, almost nobody returns everything. People steal just a little.
The explanation is that the moral cost isn’t paid all at once. It grows with the amount, but not in money. It grows in how hard it gets to keep seeing yourself as an honest person. Taking 200 reais from a found wallet fits into plenty of stories we tell ourselves: “it’s for the trouble of returning it”, “someone carrying a thousand reais won’t miss 200”, “I returned the IDs, which is what matters”. Taking the full thousand doesn’t fit into any story. Whoever takes the thousand has to admit they’re a thief, and most people would rather have less money than make that admission.
The fudge factor
Dan Ariely, a behavioral economics professor, spent years measuring this in the lab and wrote a book about the results, The Honest Truth About Dishonesty (2012). He called the central theory the fudge factor.
The basic experiment is simple. Participants get a sheet with 20 number matrices and five minutes to find, in each one, the two numbers that add up to 10. Each solved matrix is worth some money. In the control group, someone checks the sheet, and the average is 4 solved matrices. In the test group, the participant runs the sheet through a shredder and reports how many they solved. The average goes up to 6.
Two details of this result matter more than the number:
- Almost nobody reports 20. With the shredder, lying about 20 was just as safe as lying about 6. Even so, the typical behavior was to exaggerate a little, not a lot.
- The size of the reward doesn’t change how much people lie. Ariely varied the payment per matrix from 25 cents to 10 dollars. The amount of cheating stayed about the same, and at the highest amount it even dropped a bit.
His reading is that we run on two opposing motivations at once: we want the gain from cheating, and we want to keep seeing ourselves as honest. The fudge factor is the amount of cheating that fits between the two, meaning the most you can take without breaking your image of yourself. Past that point, people stop cheating not out of fear of getting caught, but because they can no longer explain it to themselves.
A second experiment, from his earlier book (Predictably Irrational), fills in the picture. Ariely left six-packs of Coca-Cola in shared fridges in an MIT dorm, and plates of one-dollar bills in others. Within 72 hours every can was gone. Not a single bill was touched. Taking a neighbor’s can is easy to fit into a story; taking a neighbor’s money is theft, and the distance between the two is one step of abstraction.
The further from cash, the bigger the fudge factor. Tokens, points, digital assets, “a can”.
The real wallets
The wallet example isn’t just a metaphor. In 2019 a group of economists published in Science the largest field experiment on honesty I know of: more than 17 thousand “lost” wallets across 355 cities in 40 countries, handed to staff at banks, hotels, post offices and police stations as if they’d been found at the door. Each wallet had a contact email, and the metric was how many people wrote in to return it.
The result goes against the intuition that more money attracts more dishonesty:
| Wallet contents | Return rate |
|---|---|
| No money | 40% |
| About 13 dollars | 51% |
| About 94 dollars | 72% |
The more money, the more people returned it. The authors’ explanation is the same as Ariely’s, seen from the other side: keeping an empty wallet is almost nothing, keeping a wallet with 94 dollars requires seeing yourself as a thief, and for most people that self-image cost weighs more than the money.
What Liquid has to do with the wallet
Go back to the 4,000 BTC with this in mind.
Whoever exploited the bug effectively had the whole wallet in hand. The network was paused, the peg-out had already settled, and Bitcoin has no chargebacks. The choice between keeping everything, returning everything or keeping part was a real one, and the answer was the same as the participant with the shredder: most of it back, a little kept.
The pieces of the theory show up one by one:
- The cheating has to fit into a story. “We are white hats” was the first message, before any negotiation. The label wasn’t for Blockstream, it was for themselves. The 15% had to be called a reward, because 598 BTC called theft doesn’t fit the self-image of someone who reports bugs.
- The unit of the fudge factor is the narrative, not the amount. 598 BTC is 47 million dollars. Nobody can tell themselves a story about “only 47 million”. But “only 15%” is a perfectly tellable story, and that’s why the fraction matters more than the total. The same mechanism that makes someone take 200 out of a thousand makes someone take 600 out of 4,000, as long as both can be called “a little”.
- Distance from the money. There was no victim with a face. The L-BTC came from a cache bug, the BTC came out of a multisig held by a federation of companies. It’s the Coca-Cola can, not the one-dollar bill. The path to “this is someone’s money” has so many steps of abstraction that the white hat story almost tells itself.
- The sad emoji. This is the most revealing part. After keeping 47 million, the last message was one of frustration. If it were only about money, the emoji wouldn’t make sense: they already had the money. What was missing was the other half of the equation, the acknowledgment that the reward was legitimate. Without it, the 598 BTC look uncomfortably like theft, and the self-image the opening message tried to establish is left without the other party’s signature.
I’m not saying these people are the same as someone who finds a wallet and takes 20%. I’m saying the mechanism is the same, and that it scales. Ariely measured the fudge factor on 50-cent matrices; Liquid measured it on a 320 million reserve, and the shape of the result was identical: most of it back, a little kept, and a visible effort to give the “little” an acceptable name.
Conclusion
The Elements bug will be fixed, audited and forgotten, like every bug. What remains is a data point on human behavior measured under conditions no lab could set up: someone with 320 million dollars and no barrier to keeping it gave back 85%.
The optimistic reading is that conscience works even when cryptography fails. The practical reading is more useful: if you run a system that holds value, the behavior of whoever finds a bug probably won’t be “all or nothing”. It’ll be “almost everything back, plus a little”. A bounty program with an amount and rules set in advance exists for exactly this: giving the “little” a legitimate name, at a size you chose, before someone chooses it for you.
And on a personal level, the wallet experiment works as a mirror. Nobody thinks they’re the kind of person who would steal 320 million. The fudge factor asks a different question: what’s the 15% you would keep and still be able to explain to yourself?
References
- Ariely, Dan. The (Honest) Truth About Dishonesty, 2012.
- Ariely, Dan. Predictably Irrational, 2008. Chapter on the Coca-Cola can experiment.
- Cohn, A., Maréchal, M. A., Tannenbaum, D., Zünd, C. L. Civic honesty around the globe. Science, 2019.
- Gerlach, P., Teodorescu, K., Hertwig, R. The truth about lies: A meta-analysis on dishonest behavior. Psychological Bulletin, 2019.
- Bitcoin Magazine: Liquid gets 3,400 BTC back after on-chain talks; white hats keep 598.5 BTC
- CoinDesk: $320 million bitcoin exploit hits Liquid Network
- The Block: Liquid Network attacker says they will return most of 4,000 BTC after bug fix
- Bitcoin.com News: Liquid hackers return 3,400 BTC, keep $47M as network stays frozen
- Blockstream: Liquid Network documentation