Untagged Elements code drained 95% of Liquid's reserve in 23 minutes

The custody assurance and the failure sat in different layers. Fifteen functionaries running tamper-proof hardware security modules in an 11-of-15 multisig signed the peg-out that emptied the reserve ^[7], and by their own lights they signed it correctly, because Blockstream says no federation key was compromised and puts the fault in a cache-key collision in the confidential-transactions verification logic, code that reached the Elements master branch without ever appearing in a tagged release ^[3]. Elements caches successful range-proof verifications because the check is expensive, and before the patch the cache key came from the proof bytes and the hidden amount without the asset type or the scriptPubKey context, so a proof that was valid in one place could be retrieved and reused where it was not ^[8].

Priming that cache was cheap: 68 identical proofs at 41 satoshis a transaction is 2,788 satoshis ^[9], and at the roughly $80,080 a coin implied by $320m against 3,996 BTC ^[2][1], call it two dollars and twenty cents of fees ^[2]. (The $47m tag on 598.5 BTC implies about $78,500 a coin ^[9], so the dollar figures are rounded from different moments and the BTC counts are the ones to work from.)

Then the detection gap. The reserve fell from 4,205 BTC to 202 BTC at 14:28 UTC on Sept 6 ^[2], block production stopped at 04:49 UTC on Sept 7 ^[6], and 14 hours and 21 minutes of blocks were produced in between ^[3]. For anyone who audits by balance, the harder point is that the counterfeit was on the liability side, since the unbacked L-BTC was minted and then pegged out ^[1], so a reserve attestation would have read a full 4,205 BTC right up to the moment the peg-out cleared ^[8].

The accounting after the return: 202 plus 3,400 is 3,602 BTC against 4,205 before, leaving the reserve 603 BTC or about 14% short ^[5], and unless L-BTC supply has been reduced by the same amount, each unit sits on a claim of roughly 0.857 BTC ^[6]. The peg is quoted at one. The reserve arithmetic says something else.

The generous reading is that the model bent rather than broke, because a stolen key takes all 4,205 BTC with nobody to negotiate with, whereas here nine on-chain messages and a verified PGP key got 3,400 BTC back after the bridge nodes were patched ^[5][4]. Against that, the 598.5 BTC kept as a self-declared bounty is 15% of what left ^[7], which is a rate the next finder can now quote, and its legal status is open: the source material frames it as an unresolved question of whether keeping $47m without a formal bounty agreement is theft or security research ^[11].

What would break the read here is evidence that the drain needed anything from the signers other than honest operation, and on Blockstream's account it did not ^[3]. Meanwhile the oldest Bitcoin sidechain, running since 2018 for exchanges, traders and tokenised asset issuers ^[7], is frozen and gated at the exchanges ^[6], which means it is settling nothing at all while the code question is answered.