Five protocols printed bitcoin that did not exist

*Between 6 and 15 September, five protocols were attacked. Four were hit in the exact same way: they were convinced a deposit had occurred, and they created the corresponding tokens.* No keys were stolen. No signatures were forged. No cryptographic algorithm gave way.

This is what makes this series instructive: it says nothing about the robustness of bitcoin, and a great deal about that of the objects claiming to represent it elsewhere.

Liquid is a bitcoin sidechain built by Blockstream. Bitcoin is deposited with a federation of fifteen members — exchanges and infrastructure companies — and in return, one receives L-BTC, supposed to be worth one bitcoin each. To retrieve one's bitcoin, eleven of the fifteen members must sign the peg-out.

On 6 September, between 13:53 and 14:28 UTC — thirty-six minutes — around 4,000 bitcoins, or nearly 319 million dollars, left the reserve. According to TRM Labs, this is the largest crypto-asset theft of 2026 (TRM analysis).

Liquid uses confidential transactions: the amount of each output is hidden. To verify that a hidden amount is legitimate, the software uses a range proof — a mathematical demonstration that the hidden value lies within an allowed range, without revealing what it is.

These checks are computationally expensive. The node software, Elements, therefore caches previously validated results to avoid repeating the work. The entire vulnerability lies in how this cache was keyed: the key was built from the bytes of the proof and the hidden amount alone — without the asset type or destination script.

The attacker broadcast 68 identical proofs over fourteen hours to prime the cache, then presented an invalid output whose key matched a previously successful check. The nodes retrieved the verdict "already verified, it's fine" and skipped the check that would have rejected the transaction. Around 3,996 L-BTC were created out of thin air, and appeared perfectly valid to all members of the federation (crypto.news reconstruction).

The fitting analogy: a checkpoint that stamps "verified" on a file and indexes the stamp under such a vague label that an entirely different, forged file matches the same label — and passes through on the strength of yesterday's stamp.

The eleven signatories did their job properly. They approved an output that their software presented to them as valid. Blockstream confirmed that no keys were compromised. *Adding more signatories would have changed nothing: the weak link was not the signature, but what determined what was being signed.*

The patch already existed. The change linking the cached verification to the asset type and destination script had been submitted to the public Elements repository on 3 August 2026, and merged into the main branch on 2 September.

The federation nodes themselves were running version 23.3.3, dated 13 April. The vulnerability had been fixed upstream for over a month when it was exploited. "Open source and audited" does not mean "up to date".

On 7 September at 16:09 UTC, the attackers returned around 3,400 bitcoins, or nearly 272 million dollars, posing as whitehats and communicating via messages written on-chain. They kept 598.5, roughly 47 million dollars.

Then came the demand: "You must pay 10% out of pocket as a bug bounty, otherwise you will inflict a 15% loss on all your holders."

Blockstream's response, to be quoted in full: "Taking assets without authorisation and withholding their return is a crime, not responsible disclosure. It is not whitehat activity. It is theft." The company refuses to set a precedent of paying a ransom for an open-source software vulnerability (The Block).

This is the key point. Reserves currently cover around 85 to 86% of L-BTC in circulation: roughly 3,600 to 3,630 bitcoins for 4,229 L-BTC, representing a shortfall of approximately 600 to 630 bitcoins — which matches, within a few units, what the attackers kept.

But it is not the ratio preventing peg-outs today. It is that peg-outs are suspended. The Liquid homepage states: "Transfers of issued assets have resumed. L-BTC transfers and peg-out operations remain suspended." Block production restarted on 10 September; returns and inflows will only come back in the third phase of a recovery plan with no announced date.

What 85% would mean if withdrawals reopened without recapitalisation: first come, first served. The first 85% get one bitcoin per L-BTC, the last get nothing. It is the structure of a bank run — and that is why Adam Back, head of Blockstream, stated on 10 September that "the 1:1 peg between L-BTC and BTC will be covered", urging holders not to sell in a panic.

Note the passive voice in this sentence. No named entity, no amount, no funding source, no date.

And beware of the price. An L-BTC trading near parity proves nothing about the level of backing: it is "a reading of confidence, not a guarantee", and thin order books can make small trades look good while hammering the execution of large ones.

Nomic and Osmosis — the most concerning of the five. A flaw in Nomic's transfer system allowed the creation of fake vouchers converted into nBTC, bypassing deposit verification. The activity began on 25 June, continued on 17 July, and was only made public in September: seventy-four days without anyone noticing. 39.84 nBTC compromised, representing 36% of Osmosis's aggregate bitcoin backing. 22.65 bitcoins frozen, a residual shortfall of 17.19.

Symbiosis, on 11 September at 4:28 am UTC. A call to the bridge contract on BNB Chain created roughly 46.1 billion syBTC — more than two thousand times the total supply of bitcoin — sent to a freshly created address. Detected by security firm Blockaid.

And here is the most instructive fact of the entire series: the attacker only managed to extract around 336,000 dollars. They were only able to offload 4.39 WBTC on Uniswap. Available liquidity, rather than the severity of the flaw, set the stolen amount. The team recovered 15 bitcoins and offered a 20% bounty for the return of the rest. The bitcoin bridge remains suspended; swaps have been redirected to third-party partners, including Chainflip.

Chainflip, as it happens, on 12 September — the following day. On most chains, a swap request goes through a dedicated contract function. TRON is an exception: Chainflip reads instructions from the memo field, a free text area attached to the transfer. The attacker attached a new memo to a transaction that validators had already signed. The validators read it as a new instruction and paid out a second time on the same deposit.

Eight attempts, six successful, in around ninety minutes, with the attacker doubling the stakes each round. 736,442.17 USDT stolen. Network paused, promised compensation for users, restart announced "Monday at the earliest".

The analogy: a cheque that has already been cashed, on which a new instruction is written in the margin — and which the bank honours a second time.

A bridge must answer a single question in software: did this deposit actually take place on the other chain, and for what amount? It must answer it from outside the chain that actually holds the asset. Bitcoin cannot verify what is claimed about it on BNB Chain. This verification gap is not an implementation detail: it is the product itself.

• Memo replay (Chainflip): the instruction is not cryptographically bound to the deposit.
• Cache key collision (Liquid): the verification verdict is not bound to the full context.
• Unbacked minting (Symbiosis): minting authorization is not bound to a verified deposit.
• Fake vouchers (Nomic): deposit verification is purely and simply bypassed.

*And the gap between 336,000 dollars and 319 million does not boil down to the severity of the bug. It boils down to what lies behind it. Symbiosis created 46 billion tokens and was only able to extract just over three hundred thousand dollars due to a lack of liquidity on the other side. Liquid created 3,996 and converted them all because a federation was honouring withdrawals against a real, deep reserve. The promise of redemption that gives a wrapped token its value is precisely what makes its bugs ruinous.*

On 11 September, Revolut began notifying customers that their data had been passed to a third party. The mechanism, in the company's words: "An unauthorised third party used the legitimate email domain of a government agency to submit fraudulent information requests."

What was compromised: names, dates of birth, postal and email addresses, phone numbers, occupations, copies of passports and driving licences, identity verification selfies, bank statements, IBANs, and full transaction histories — bitcoin included. What was not compromised: passwords, login credentials, biometric data. Funds were unaffected.

This modus operandi has been documented since 2022 by journalist Brian Krebs: the fake emergency request. An emergency request allows police to obtain data without a warrant when a life is at stake — it bypasses most controls. Attackers compromise a genuine police email account and write from it: the domain is real. Apple, Meta, Snap and Discord fell for it in 2022, Discord in under an hour (Krebs on Security).

The problem is structural: in the United States alone, there are around 18,000 law enforcement jurisdictions. Compromising just one is enough. There is no central verification authority.

The aftermath was predictable. The attackers published excerpts in Telegram groups and are demanding 10,000 bitcoins, or approximately $780 million, threatening daily releases. Revolut has not commented on the demand, nor stated how many customers are affected — 'a limited number' — nor which agency was impersonated.

No regulator has announced a formal investigation at this stage. Mentions of preliminary reviews are journalistic speculation, not established fact.

In the first half of 2026, TRM Labs recorded $972 million stolen across 207 attacks, compared to around $2.3 billion in the first half of 2025. Less than half the amount, but a record number of incidents. More attacks, smaller hauls.

And above all: around 75% of the stolen value stems from key or infrastructure compromises, not smart contract bugs. Code bugs remain the most frequent type of incident, but not the most costly. Around $643 million, or two-thirds of the total for the half-year, is attributed to actors linked to North Korea.

• A wrapped bitcoin is not a bitcoin. L-BTC, syBTC, nBTC are claims on an issuer's reserves and on its software. Not on Bitcoin. Today, an L-BTC holder can neither exit nor even transfer.
• Coverage ratios are public — go look at them. Liquid publishes its reserves and peg operations open access. On 7 September, prior to the restitution, this same statement showed 197 bitcoins for 4,205 L-BTC: a coverage of 4.7%. A coverage figure without a timestamp is worthless.
• A price close to par proves nothing. It is a measure of confidence, not solvency.
• Spend as little time as possible in wrapped form. A bridge is for conducting a transaction, not for holding.
• Your identity data is a permanent liability. A passport and a selfie cannot be changed like a password. Expect targeted phishing citing real information about your account — and treat as hostile by default any unsolicited contact that knows too much.

A final warning, because it goes against the grain: do not draw an optimistic lesson from the recovery rate. Liquid recovered 85%, Symbiosis 15 bitcoins, Chainflip promises to compensate. This is exceptional. In the vast majority of cases, stolen funds never come back.

Crypto Hebdo provides information and offers no investment advice. Crypto-assets are volatile and you may lose all or part of the capital committed.