Blab Crypto
Rootstock Calls for Mandatory Withdrawal Delays After Liquid Network Bridge Breach
On September 6 2026, an unauthorized peg‑out on the Liquid Network exposed a flaw that let unbacked L‑BTC be exchanged for real Bitcoin, sending nearly 4,000 BTC out of a federation wallet. The breach, handled by SideSwap, a liquid peg‑out service, left 598 BTC unreturned and forced the network to halt peg operations until September 10, when block production resumed. RootstockLabs co‑founder Sergio Lerner seized the moment to demand that bridge operators adopt mandatory time‑delay locks, arguing that the incident demonstrated how a single validation bug can wipe out funds instantly.
The incident began when a customer sent 4,000 L‑BTC to SideSwap, which could not distinguish the tokens from properly backed ones. The service accepted the request, and the federation transferred 3,996 BTC to the supplied address 23 minutes later. Blockstream and federation members patched the software after the fact, and the actors returned 3,400 BTC, leaving 598 BTC outstanding. Liquid described the actors as purported white‑hat hackers, while SideSwap maintained that the request followed its normal process.
Rootstock already implements a 36‑hour delay for BTC withdrawals via its two‑way peg. The mechanism relies on PowHSMs—hardware security modules that independently verify that 4,000 Rootstock blocks, roughly 36 hours of cumulative proof‑of‑work, have passed before a private key can sign a transaction. The keys never leave the devices, and functionaries cannot instruct the hardware to bypass the required period.
Lerner explained that a mandatory delay would give bridge operators several hours to spot and halt unauthorized withdrawals. Monitoring tools could compare a peg‑out request with the BTC backing the L‑BTC and flag any imbalance before settlement. Functionaries could pause the peg before the hardware signs the transaction or releases BTC from the federation wallet. Even if software mistakenly approved a withdrawal, the delay would prevent the corresponding BTC from leaving immediately.
The proposal also references BIP‑443, a draft Bitcoin Improvement Proposal that introduces OP_CHECKCONTRACTVERIFY (OP_CCV). If activated, a Bitcoin output could carry data and restrict how its funds may move in future transactions, allowing native vaults to give users or designated parties time to cancel a withdrawal after detecting stolen credentials or altered software. Lerner argued that moving the mechanism into Bitcoin consensus would reduce reliance on bridge‑specific HSM policies and enforce spending conditions at the network level.
The Liquid breach underscored the need for robust safeguards that let operators intervene before funds exit the network. Lerner suggested that withdrawal periods could vary by transaction size or collateral risk, mirroring how physical bank vaults operate. While Rootstock’s approach relies on hardware and federation rules, the push for distributed revocation controls and consensus‑level vaults could offer a more resilient framework for protecting Bitcoin and other assets in cross‑chain transactions. Industry observers are now watching whether BIP‑443 or similar mechanisms will be adopted to standardise withdrawal delays across bridges and reduce the risk of future unauthorized withdrawals.
Liquid Network has remained offline for peg operations since the breach, and the 598 BTC that were not returned as of September 10 remain unclaimed. The federation has not announced a timeline for restoring full functionality, and its decision to suspend peg operations underscores the severity of the incident. Market participants have noted that the halt limits liquidity for users who rely on Liquid for fast, low‑fee Bitcoin transfers, and several exchanges have temporarily paused trading of L‑BTC to mitigate exposure.
If consensus‑level vaults like those envisioned in BIP‑443 are adopted, bridge protocols could standardise withdrawal delays without relying on proprietary hardware or federation rules. The mechanism would embed spending conditions directly into Bitcoin outputs, allowing miners and functionaries to enforce them automatically. Such a change would shift the burden of delay from bridge operators to the Bitcoin network itself, potentially reducing the attack surface for malicious actors. However, integrating OP_CCV into Bitcoin consensus would require a hard fork and widespread coordination among miners, which is unlikely in the short term.
The incident began when a customer sent 4,000 L‑BTC to SideSwap, which could not distinguish the tokens from properly backed ones. The service accepted the request, and the federation transferred 3,996 BTC to the supplied address 23 minutes later. Blockstream and federation members patched the software after the fact, and the actors returned 3,400 BTC, leaving 598 BTC outstanding. Liquid described the actors as purported white‑hat hackers, while SideSwap maintained that the request followed its normal process.
Rootstock already implements a 36‑hour delay for BTC withdrawals via its two‑way peg. The mechanism relies on PowHSMs—hardware security modules that independently verify that 4,000 Rootstock blocks, roughly 36 hours of cumulative proof‑of‑work, have passed before a private key can sign a transaction. The keys never leave the devices, and functionaries cannot instruct the hardware to bypass the required period.
Lerner explained that a mandatory delay would give bridge operators several hours to spot and halt unauthorized withdrawals. Monitoring tools could compare a peg‑out request with the BTC backing the L‑BTC and flag any imbalance before settlement. Functionaries could pause the peg before the hardware signs the transaction or releases BTC from the federation wallet. Even if software mistakenly approved a withdrawal, the delay would prevent the corresponding BTC from leaving immediately.
The proposal also references BIP‑443, a draft Bitcoin Improvement Proposal that introduces OP_CHECKCONTRACTVERIFY (OP_CCV). If activated, a Bitcoin output could carry data and restrict how its funds may move in future transactions, allowing native vaults to give users or designated parties time to cancel a withdrawal after detecting stolen credentials or altered software. Lerner argued that moving the mechanism into Bitcoin consensus would reduce reliance on bridge‑specific HSM policies and enforce spending conditions at the network level.
The Liquid breach underscored the need for robust safeguards that let operators intervene before funds exit the network. Lerner suggested that withdrawal periods could vary by transaction size or collateral risk, mirroring how physical bank vaults operate. While Rootstock’s approach relies on hardware and federation rules, the push for distributed revocation controls and consensus‑level vaults could offer a more resilient framework for protecting Bitcoin and other assets in cross‑chain transactions. Industry observers are now watching whether BIP‑443 or similar mechanisms will be adopted to standardise withdrawal delays across bridges and reduce the risk of future unauthorized withdrawals.
Liquid Network has remained offline for peg operations since the breach, and the 598 BTC that were not returned as of September 10 remain unclaimed. The federation has not announced a timeline for restoring full functionality, and its decision to suspend peg operations underscores the severity of the incident. Market participants have noted that the halt limits liquidity for users who rely on Liquid for fast, low‑fee Bitcoin transfers, and several exchanges have temporarily paused trading of L‑BTC to mitigate exposure.
If consensus‑level vaults like those envisioned in BIP‑443 are adopted, bridge protocols could standardise withdrawal delays without relying on proprietary hardware or federation rules. The mechanism would embed spending conditions directly into Bitcoin outputs, allowing miners and functionaries to enforce them automatically. Such a change would shift the burden of delay from bridge operators to the Bitcoin network itself, potentially reducing the attack surface for malicious actors. However, integrating OP_CCV into Bitcoin consensus would require a hard fork and widespread coordination among miners, which is unlikely in the short term.
