The attacker's self-set 15% leaves Liquid's peg wallet about 600 BTC short

SlowMist's own figures, about 3,998.5 L-BTC worth roughly $320 million ^[5], imply something near $80,030 a coin ^[1]. That values the 598.5 BTC the attacker kept at roughly $47.9 million ^[2]. The 10% asked for in OP_RETURN messages ^[10] would have been 399.85 coins, so the extra 198.65 taken without anyone agreeing to them came to about $15.9 million ^[3].

None of that came out of Blockstream. It came out of the peg wallet, which held over 4,200 BTC before September 6 and about 197 after ^[6]. Add back the roughly 3,400 returned once the patch shipped ^[11] and the pool sits near 3,597 ^[4], no more than about 86% of the balance it had before ^[5]. The returned 3,400 and the retained 598.5 sum to exactly the 3,998.5 minted ^[6], so the wallet's remaining hole is the fee and nothing else. Every L-BTC still outstanding is a claim on that pool. SlowMist's analysis does not say who covers the difference.

The failure was in verification code. Blockstream confirmed the incident was caused by a software bug and that the federation's signing keys were not compromised ^[9], and SlowMist locates the flaw in a performance optimisation ^[14]. Adding more signers would not have bounded this loss, because the honest signers were signing peg-outs that the software told them were valid.

So the interesting number now is the price of L-BTC against BTC. I would expect it to trade under one while the pool is short 598.5 coins ^[11]. If it holds parity, the market is pricing Blockstream's willingness to make holders whole, and a reserve token whose price ignores its reserve is being valued on a corporate promise. That is falsifiable within weeks of peg operations reopening.

The counter-case is that this was cheap. Ninety-five percent of the reserve left the wallet before anyone noticed, and the network stayed offline four days ^[12]. The realised loss came to 598.5 coins, roughly 14% of the starting balance ^[7]. A federated peg that loses a seventh of its backing to a validation bug and gets six sevenths back has, on the evidence, survived its worst day for 598.5 coins.

SlowMist flagged the missing length prefixes in cache key construction as the enabling factor and said other projects using similar patterns should audit them ^[13].