TheNostr Observer

The Shared Code Trap: 4,000 Bitcoin Drained From Liquid as Multisig Agrees With a Flaw

Fifteen independent signers, zero stolen keys — and eleven honest machines approving a bug that emptied the sidechain.

By the Observer Editorial Desk

The security model was supposed to be bulletproof: fifteen geographically distributed companies guarding independent cryptographic keys, requiring eleven concurrent signatures before funds could peg out from Liquid to mainchain Bitcoin. Yet when an exploit struck on Wednesday, eleven legitimate signers dutifully approved a withdrawal that drained nearly every satoshi in reserve.

Ungovernable reported the scale of the collapse: Roughly 4,000 Bitcoin was withdrawn from Liquid after a software bug allowed LBTC that should never have existed to be accepted as valid. Over $320 million in value crossed the bridge, leaving barely 150 to 200 Bitcoin on the entire sidechain before block generation halted.

The failure tore through assumptions about threshold security. As Ungovernable observed, Every signer was reading the same faulty software, so every signer agreed. The number of keys does not fix a shared code failure. Obi crystallized the broader lesson: The real question is not trusted vs trustless. It's how many independent things have to go wrong before you lose money.

Dispatched from commentary by Ungovernable, Ungovernable on the federation, and Obi.

The Phishing Wave That Came From Inside the House

While developers dissected the Liquid exploit, hardware wallet users faced a coordinated social engineering strike. Compromised newsletter and notification providers sent spoofed critical security warnings from legitimate BitBox, Trezor, and CoinTracking sender addresses, complete with valid DKIM signatures and official manufacturer domains.

The incident ignited fresh demands for sovereign infrastructure. Timothy Allen argued: Trezor should stop using third parties. Time to do it all in-house. AZA_21m counted the summer's cumulative fatigue: Coldcard swipe vulnerabilities, Trezor courier leaks, the Liquid drain, and now BitBox inbox intrusions.

Cited from Timothy Allen.

Calling on Cypherpunks: elsirion Proposes Multi-Implementation Federations

With machine learning shifting leverage toward attackers, Fedimint looks to Cashu's diverse ecosystem to eliminate mono-culture code risks.

The Liquid collapse has catalyzed what may become the most consequential architectural pivot in federated Bitcoin systems. Fedimint lead elsirion issued an open call across the network: Calling on fellow cypherpunks to build alternative Fedimint implementations.

The Liquid hack shows once again that single points of failure are what will break our systems and that includes the code we write. With automated code analysis lowering the barrier for exploits, he warned, Security is an asymmetric game: an attacker has to find one weakness, while defenders have to find all. AI has permanently changed the attacker-defender balance for the worse.

His economic model for security is straightforward: The assumption is that there are diminishing returns to trying to make one code base secure. Eventually you'll have to spend twice the effort to make it a little bit more secure. Drawing inspiration from Cashu's multi-client, multi-mint ecosystem, he announced funding for independent teams operating purely off an extracted specification, purposefully disconnected from the original codebase.

Dispatched by elsirion's manifesto and his diminishing returns analysis.

The Cost of Compliance: Pocket Bitcoin Records Leaked

A leak of Pocket Bitcoin compliance archives exposed 291 full user dossiers and 5,120 names, IBANs, and transaction values, permanently binding individual legal identities to public on-chain transactions. As Ungovernable noted, an address alone reveals nothing, but leaked regulatory records strip privacy forever: true sovereign custody demands acquiring coins without central identity registries.

Reported by Ungovernable.