A security breach on the Bitcoin sidechain Liquid Network has put the risks of layered crypto infrastructure back in focus after attackers transferred roughly 4,000 BTC, worth about $320 million at the time, by exploiting a validation flaw in the Elements software. The incident did not involve compromised federation keys or PAK keys, indicating that the attackers found a route around controls designed to protect the network’s underlying signing material.
The group later returned 3,400 of the stolen tokens on September 7, while retaining 598.5 BTC—worth roughly $47 million—as what it described as a reward for discovering the vulnerability. Blockstream Chief Executive Adam Back has said he would restore the missing reserves personally, while peg operations remain frozen as the company’s technical team works on replacing the lost funds.
Liquid’s peg allows BTC to move between Bitcoin’s main chain and the sidechain, where assets can be used for faster and more confidential transactions. Freezing peg activity limits the risk of further imbalance between Liquid Bitcoin and reserves held on the Bitcoin network, but it also restricts users’ ability to move funds through the system until the reserve position is repaired.
A flaw outside the key vault
The Liquid episode illustrates a security problem that traditional custody controls cannot solve on their own. Federation keys and PAK keys are meant to limit who can authorize critical actions, yet the reported validation flaw allowed harmful activity without taking possession of those credentials.
That distinction places the focus on software rules governing when signed actions are accepted. A system can maintain strong protection for key material and still face a serious loss if a bug causes it to recognize an invalid transaction, withdrawal, or asset state as legitimate.
The recovery of most of the funds reduced the immediate deficit, but the remaining 598.5 BTC leaves a material gap for a network whose peg depends on confidence that issued assets remain backed. Back’s pledge to cover the loss would address that shortfall if implemented, though the operational freeze shows that recovery of assets and restoration of normal network activity are separate processes.
Cosmos evm attacks exposed response-time risks
A separate series of attacks in August showed how a disclosed vulnerability can remain dangerous while projects work through patching and coordination. Attackers exploited a critical Cosmos EVM flaw across multiple networks, with six chains reported to have been directly affected.
The attackers sold about $5.72 million in digital assets after targeting smaller networks including MANTRA and TAC during a five-day period before emergency fixes were deployed. The issue had reportedly been submitted earlier through a bug bounty channel, raising questions about how quickly critical reports were assessed, escalated, and converted into protective action.
Cosmos EVM chains combine the Cosmos software ecosystem with Ethereum-compatible smart-contract functions. That compatibility can help developers deploy familiar applications, but shared components can also create common points of failure across otherwise separate networks.
The episode did not depend on stolen keys or phishing. Its pressure point was vulnerability management: whether an identified software defect could be fixed, communicated, and mitigated across affected operators before it became an active exploit. Smaller networks can face particular difficulty when they lack large security teams or need to coordinate upgrades with validators, infrastructure providers, and application developers.
Triple-a breach began with employee credentials
In July, payments firm Triple-A faced a different threat when a social-engineering attack obtained employee credentials and used them to enter an operations environment. Some company-owned assets were transferred, while client funds were not affected because they were held separately in trust accounts.
The breach demonstrates why a compromised staff account should not automatically provide access to the systems that can move customer or treasury funds. Separating client assets from operational balances limited the damage in Triple-A’s case, while the attackers’ ability to enter an internal environment showed that credential theft can bypass safeguards that exist only at the blockchain or wallet layer.
Phishing campaigns have become more convincing through fake browser windows and cloned company portals that imitate legitimate login pages. Such attacks seek a human decision rather than a cryptographic weakness: a worker enters credentials into a convincing fraudulent interface, and the attacker then attempts to reuse them against real systems.
Multi-factor authentication, device checks, session controls, and approval workflows can make stolen passwords less useful. Their effectiveness depends on whether those controls remain separate from the compromised identity and whether sensitive actions require additional people or systems to approve them.
Bit outlines layered controls
BIT, formerly Matrixport, has framed its version 2.0 BIT Trust Whitepaper around that separation of powers. The document describes a control model that divides identity management, permissions, operational approvals, monitoring, and asset storage into multiple checkpoints rather than relying on a single security boundary.
According to the whitepaper, staff access is governed by least-privilege principles, which limit employees to permissions needed for their assigned work. It also says that asset transfers, account-security changes, permission changes, and the creation or review of trading instructions require at least two authorized participants.
That design would make a stolen employee credential less likely to result in an immediate transfer, assuming the second approver, monitoring systems, and wallet controls remain independent. It also addresses a recurring weakness in crypto operations: an account that begins with limited access can become highly dangerous if it can alter permissions, disable security settings, or initiate withdrawals without meaningful oversight.
The paper says BIT monitors abnormal logins, unrecognized devices, and unusual withdrawal behavior continuously. It also states that most digital assets are held in cold wallets, reducing the amount available to an attacker who gains access to an internet-connected operations environment.
Cold storage does not eliminate software or insider risk, but it can narrow the pool of assets reachable through an online intrusion. The Liquid breach, by contrast, shows that protection of stored keys must be paired with robust validation of the software that interprets transactions and manages reserves.
Security teams gain a formal veto
BIT’s document also gives its security team authority to halt work when product plans, requirements, architecture, or release changes create major security concerns or fail to meet security and compliance baselines. Activity resumes only after remediation and another review, according to the whitepaper.
That governance model places security review before deployment rather than treating it as a post-incident task. The Cosmos EVM cases show the cost of delayed remediation, while the Triple-A breach shows why operational access needs constraints even after an attacker has crossed an initial authentication barrier.
For its U.S. equities operation, BIT says Matrix Gelephu Pte. Ltd. runs the securities business under GFSO oversight and connects with U.S.-licensed financial institutions and associated clearing and custody infrastructure. Extending dual authorization, restricted permissions, and monitored operations into securities workflows would apply the same basic controls to token-related activity and conventional market access.
Across the three incidents, the decisive question was what an attacker could do after the first control failed. Software bugs, delayed patches, and stolen credentials require different defenses, but each can become far more costly when a single technical flaw or staff account can reach privileged workflows and online asset stores.
Worried about breaches like Liquid’s? Strengthen your defenses with Toobit’s security guide learn from crypto security breaches today.
Disclaimer: The content on this page is provided for general informational purposes only and does not represent the views or financial advice of Toobit. We make no guarantees regarding the accuracy or completeness of this information and shall not be held liable for any errors, omissions, or outcomes resulting from its use. Investing in digital assets involves risk; users should independently evaluate their financial situation and the risks involved. For further details, please consult our Terms of Service and Risk Disclosure.
