SideSwap: Customers exchanged 4000 L-BTC minted from vulnerabilities

SideSwap issued a statement saying that at 14:05 UTC today, a customer sent 4000 L-BTC to its peg-out service. The service processed the order as usual, L-BTC was destroyed on Liquid with a valid peg-out authorization, and at 14:28 UTC, Liquid Federation paid 3996 BTC to the customer's Bitcoin address.

Blockstream subsequently confirmed that the L-BTC was minted due to a vulnerability in the Elements software. SideSwap's peg-out authorization keys and systems were not compromised, and the service cannot distinguish these tokens from other L-BTC. SideSwap is a non-custodial service, and user wallets are unaffected, with assets controlled by the users' own keys.

Liquid has been suspended by the Federation, and SideSwap's exchanges, peg-ins, and peg-outs will be paused until the network is restored. Peg-outs that have been completed on Bitcoin are unaffected. Unfinished peg-ins or peg-outs can send transaction IDs to hello@sideswap.io for separate processing. Please do not send new peg-in or peg-out deposits until the service is restored.