Bitcoin Red Team Allegedly Reported Liquid Bug Before 4,000 BTC Incident
As the efforts to recover the nearly 600 BTC remaining from the Liquid exploit incident continue, a group of security developers has raised concerns that this theft could have been prevented. The Bitcoin Red Team, a volunteer group dedicated to auditing and disclosing vulnerabilities in bitcoin-aligned projects, indicated that they had previously reported the vulnerability that was exploited to transfer close to 4,000 BTC from the Liquid federation wallets.
In response to a statement by Blockstream founder and CEO Adam Back, who attributed the hack to a flawed AI bug fix, Bitcoin Red Team co-lead Calle suggested that the incident could have been avoided if Blockstream had heeded their warnings. Calle expressed disappointment, stating, “Turns out it only costs you 600 BTC to ignore an email from the red team.”
However, Blockstream denied ignoring any security warnings and emphasized that the vulnerability stemmed from an erroneous bug fix related to an AI-discovered non-critical bug. Former Blockstream CSO Samson Mow refuted claims of negligence, highlighting the professionalism of the Red Team.
Calle hinted at discrepancies in the accounts of the disclosure process leading up to the hack, indicating that the Red Team would provide a detailed report once Blockstream completes its postmortem on the liquid hack. Following the incident, Liquid had temporarily halted transactions but resumed block production on September 10. Despite this, peg-outs remain disabled as a precautionary measure, with no specified timeline for their reactivation.
At present, the white-hat hacker retains control of the remaining BTC, necessitating a third party to deposit the required assets to maintain a 1:1 peg between BTC and L-BTC, the native liquid asset. The situation underscores the importance of robust security measures in safeguarding digital assets within the blockchain ecosystem.