No. EEAAF2 Monday, September 7, 2026 24h to 15:10

TheNostr Observer

Printed from one corner of the network

Ranked as EZ 567 events, 14 desks 153 voices

Liquid Network

Ninety-five per cent of the reserves walked out, and the fix had been written a month earlier

A seven-year-old shortcut in a verification cache let someone conjure L-BTC out of nothing. The patch existed on 3 August. It was never released.

Liquid stopped on Sunday night. By Monday morning the people on this page had assembled, between them, a better account of what happened than any single one of them had at the start — which is the thing a network is actually for, and it does not happen often enough to go unremarked.

The mechanism is almost banal. Liquid hides amounts and asset types behind cryptographic commitments and range proofs. Verifying those proofs is expensive, so about seven years ago a cache was added: check a proof once, and if the same bytes turn up again, do not check them twice.

The cache compared the range-proof bytes and the value commitment. It did not compare the asset type, and it did not compare the output script. So an output carrying a different asset and a different spending condition could present a proof that had been valid for something else, and the cache would wave it through. That is enough to create L-BTC with no bitcoin behind it.

From there nothing clever was required. The fabricated tokens went through SideSwap for real bitcoin, and the peg-out did exactly what a peg-out does: burned the tokens, and had the Federation multisig send the coins out. In markusturm's account, 3,996 bitcoin.

The part that will be argued about for weeks is the timeline. Blockstream had already found the cache bug and committed a fix on 3 August 2026, merging it to master on 1 September. No release carrying that patch was ever published, and SideSwap was still running an unpatched build. Nobody on this page could say why.

gandlaf21 spent the evening trying to make the official framing cohere and could not: tf does that even mean: they withdrew it with that PAK key, but the key wasn't compromised?? Makes no sense

Others read the chain rather than the statements. optout noticed the coins had not actually gone anywhere: The ~4000 coins are being moved to the same address in this tx, so not really transferred. gandlaf21, checking again the next morning: Kinda crazy that it still hasn't moved since, by either party.

Whether "white hat" survives contact with the facts is the open question. Blockstream is negotiating with somebody who is holding 95% of a federation's reserves and has published terms. Gzuuus was blunt — Hacked on Sunday... And they call themselves white hat hahaha evil — and Alan ₿ read the on-chain message as insurance: "We are whitehats" feels like a cover in case the hackers get caught eventually.

In brief

What is known

A caching bug in Elements, the software Liquid is built on, let somebody mint L-BTC that no bitcoin stood behind. Around 4,000 bitcoin — put at some 95% of the Federation's reserves — left the multisig by an ordinary peg-out.

Liquid is halted. Bridge nodes are disabled, and L-BTC deposits and withdrawals are suspended, a decision taken by Blockstream together with Federation members.

No Federation key was compromised, and no Peg-out Authorization Key either. Other assets issued on the network were untouched.

The taker identified themselves on-chain — we are whitehats. contact us on chain — and is negotiating by OP_RETURN. They have said they will return most of it, but only once the bug is fixed and every node has updated.

The instrument

Two out of four hundred

The unranked control read returned 400 notes. Two of them also reached this page.

The ranking relay was unreachable for part of the morning, which is its own small story and may have thinned some desks. Editions are still fixed at 24 hours.

One of three screenshots Jan Kotas posted while reporting on the Liquid Network incident.
One of three screenshots Jan Kotas filed on Sunday night with the verdict: Jeez, this looks bad. Even if the white hats return the coins, it's gonna be a big hit for Liquid.Filed by Jan Kotas

Overheard

Kenshin, on the arithmetic: Nice... 1 in - 4000 out... Looks legit! 😅

unit, filing the headline everybody else wishes they had written: Liquid Network: Simplicity has it's Complications

Knut Svanholm, on the general situation: Clusterfuck around and clusterfind out. Logen, four hours later and apparently unable to leave it: Fustercluck around and fusterclind out.

Logen again, on the federated model: That's a quorum nightmare.

And Big Barry Bitcoin, asking the question the fix depends on: So a bug fix would be a consensus change and a fork right?

The double edge

The same tool found the hole and shipped the fork

Two posts on the same day, by people not talking to each other, describe the identical capability from opposite ends.

markusturm's write-up of the incident is titled, in German, How an AI found a seven-year-old bug in thirty seconds — and why a code review process never caught it. Its opening line is the sentence to keep:

Die Werkzeuge, die uns retten können, sind dieselben, die uns gefährden können.

The tools that can save us are the same ones that can endanger us — and what matters is who reaches for them first, and more cleverly.

Ungovernable spent the same day on the other end of that sentence. Somebody wanted miniscript support in Liana; an issue had been open for three years and had gone nowhere. So GG put the clankers to work and built the fork himself, plus a standalone bridge so it talks to the live Liana desktop without patching Liana at all.

They are careful about what that is worth, which is why it is worth reporting: Nobody is claiming these forks are safe to hold funds on. But getting 95% of the way there, so an actual engineer can pick it up and review it properly, is completely fucking wild.

Their closing line explains why this column exists at all: This is the other side of the AI story, and it does not get the headlines the hacks do.

The Week So Far

One of five photographs daum3ns posted on returning from several weeks travelling in a van.
One of five pictures daum3ns filed on getting back from a few weeks away — a festival, then, in their words, nature only.Picture: daum3ns

Everything that happened while one man was off the internet

The best summary of the fortnight came from somebody who had missed all of it. daum3ns came back from weeks in a van, opened the network, and read the changelog of the world in one sentence:

the last thing i saw was the coldcardhack an the chain split, now there is a blake2b fork and a liquid hack..

Four items, no adjectives, and a shrug — what intresting times to be alive 😊 — followed by the only piece of advice anybody offered all day that costs nothing: just don't forget to switch off the net and enjoy nature from time to time.

The other grievance

Running underneath the Liquid story all day, and older than it, was an unhappiness with Coinkite that this page cannot fully account for — the events behind it fall outside the window. What is on the record is the temperature.

Ranger Andy noted the response: Coldcard turning off the comments on their tweets. LWB was thinking about the endorsements — to thing how many influencers back in the day of bitcoin twatter used to shill this company as the gold standard of security.

Kenshin arrived late and did not soften it: I am a bit late to the party... But I am very sorry to hear stories about people losing their life savings due to incompetence of Coinkite... What a mess. By Monday morning, surveying the whole field: It feels like they are all competing for incompetence...

Books & Ideas

Do you think readers can't tell, or that they don't care?

fiatjaf spent Sunday evening marking up Bryan Cantrill's essay The Revolt of the Reader, published two days earlier, and the passages chosen make an argument on their own.

We readers are left with pointed questions for those promoting LLM-authored pieces: do you think readers can't tell? Or do you think readers don't care?

Cantrill's charge is not that machine-assisted prose is bad, but that its authors are not present in it: those writing with LLMs are either not reading enough to see the LLM's obvious structural tells — or (and?) they aren't even reading their own content.

And the cost, which is reputational rather than literary: At best, they will wrap your otherwise real content in constructs that cause people to skim or otherwise stop reading; at worst, they will cause people who see it for what it is to question your authenticity entirely.

The editor notes the obvious, and declines to squirm about it: this page was assembled by a machine, from other people's words, and every quotation on it is checked against the original before it prints.

Scaffolding, or substitution

Gzuuus marked a passage from a paper on arXiv that gives the same worry a sharper instrument. Assistance that improves your output can quietly reduce your engagement, your recall and your sense of having written the thing — so the useful distinction is what the help does to your next attempt:

Scaffolding reduces immediate cognitive demands while preserving or increasing the user's subsequent capacity to perform the task; substitution removes the need to perform the underlying cognitive operation.

Why nobody's family is here

Marc answered a question fiatjaf had put to the room — why don't you invite your friends and family to Nostr? — with the least flattering answer available: I did. They weren't interested.

crany, separately, diagnosed the same wall from the other side: key signing, relay configuration and building your own feed are things most people have no patience to work out.

Custody

Against reflexive multisig

Big Barry Bitcoin made the unfashionable case, on a day when everyone was frightened: I think that people who blindly recommend Multisig give it too much credit and possibly underestimate the security that a single private key already gives you.

The argument is about competence, not cryptography — keys kept together, attack surfaces never honestly assessed. If you can do Multisig properly, you can probably do single sig properly with more ease. Multisig, in their view, is for collaborative custody.

And a compliment to Lightning

The same writer, looking at the wreckage of a simpler system: Lightning is still 10x more complex. I'm actually surprised there hasn't been a flurry of attacks and bug finds constantly coming out for lightning non stop. The verdict was Reservedly impressed honestly.

Coming tomorrow

Blitz Wallet spent the weekend teasing the end of the seed phrase: For years, getting someone into Bitcoin meant the same wall: write down 12 words, don't lose them, good luck. Tomorrow, that wall comes down.

Solving it yourself

BitcoinBabies had paid the mothers in their programme every Sunday for two years using a batch payment feature at Blink. It was deprecated, leaving them with a mountain of manual work.

So they built a replacement on the Spark SDK and posted a video of it paying out beside the Blink app, both pointed at the same non-custodial wallet. But the Bitcoin ethos is about solving your own problems.

Their Week 23 lesson, on human rights and personal sovereignty, has Linda Wambui as guest speaker.

Gardens, Kitchens & Crows

Progress with the crows

Avis has been working on this for a while, and Monday brought a result: I think I have turned a corner with the crows, they are hanging out on the ground more often these days.

The household has also expanded. My crows have started hanging out with this wood pigeon, I think they consider it a sort of pet😊 — the reasoning being, in Avis's telling, that the peanut supply is now good enough that the crows can afford to adopt a dog.

Filed to #crowstr, twice, a couple of minutes apart, with the second attempt spelled properly.

A photograph A.A.Ron shared alongside a note about the Alaska State Fair Cabbage Weigh-Off.
Filed with A.A.Ron's congratulations to Scott Robb, who won this year's Alaska State Fair Cabbage Weigh-Off with an entry of 122 pounds.Filed by A.A.Ron

The gardener's own assessment: That's more cabbage than I grow in my whole garden.

The milkweed is for the bugs

GrowMilkweedPlants spent the weekend collecting seed and defending the method: All summer long the haters tell me the bugs are bad for milkweed. For me, the milkweed is for the bugs. And both are doing okay!

Also from the same account, an origin story for a habit: honey as the sweetener in coffee, learned in Costa Rica twenty-one years ago.

A useful fact

twentyone, on the heat sweats that follow a winter roast, reports it is a histamine question — longer ageing and slower cooking mean more of it — and that the fix is a bowl of frozen blueberries. Their standing position: Blueberries are the best fruit ever created.

A drone photograph danielw took near Durango, Colorado in March 2019, captioned by them as clouds and mountains.
danielw filed a drone shot of clouds and mountains around Durango, Colorado, taken in March 2019 — one of a run of old frames they have been posting to #photostr.Picture: danielw

And a goodbye

Marininha marked the last Sunday churrasco of the year, and then, at half past eleven at night: I confess that I'll miss the community here.

The Wire

Money and borders

Article 21c — Wilder flagged a rule taking effect on 11 January 2027: a bank established outside the EU may not take deposits, lend, or issue guarantees to clients resident in the EU unless it opens a licensed branch in that member state. Filed in English and in Slovak.

Strike is doing what Ken called shotgun KYC in Europe, reportedly on very small amounts.

Loki, on billboards Morena ran in Mexico against seventy years of one-party rule: I often think the same thing about world reserve currencies.

From Stacker News

The Liquid pegout thread reached 1,843 sats and 39 comments, the busiest item of the day. A companion post asked whether the chain had stopped entirely: Did Liquid just stop mining? Last block mined 4h ago.

Also carried: a survey on the natural mNAV of treasury companies, a claim that SpaceX is building a Louisiana spaceport, and the news that Nitter is unarchived and will continue.

Releases

Ditto 2.38.1 and Mostrix 0.3.1 shipped, alongside KeyOS 1.3.2, which prepares Passport Prime for its next version. Team Soapbox also published Armada, a community chat app with serverless, end-to-end encrypted spaces.

Freedom.Tech's weekly patch board recorded no CVEs and no coordinated security patches — a sentence that reads differently after the weekend than it did when it was written.

The Diary

Coming up

Thursday, September 101 Second On The Clock, billed as a gathering of individuals who believe the team up north paid off the referees and that Western Michigan got robbed. Location given as everywhere, all the time.

Friday, September 18 — Meetup Parma e Piacenza, half past six in the evening, Italian time. The listing asks whether Bitcoin died again in 2026 after a whole summer of attacks, and how the people who study it reacted.

Only two listings arrived in the window. A thin diary is a thin diary.

On air

Scottie's BTC Beats — This Is Why We Nostr went up three times over the morning, most recently at ten past three, Kyiv time.

The Lightning Goats live goat feeder has been running since Sunday afternoon. ScardustTV has been up since Saturday.

Streams end; a static page cannot know when.

Classified

A good day for small growers. Red milkweed seed, hand-collected in New Jersey, from $3 for three seeds to $10 for twenty-five; oval-leaved milkweed alongside it at up to $25.

From a family olive grove in Sparta, Costos extra virgin olive oil at $21 the 500ml bottle, and Cretan wildflower honey at $16.

At the other end: a 2023 Yamaha XMAX 300, one owner, 15,000km and just serviced, €4,500. And a replica Spain shirt, never worn, €10.

Printed for EZ from 567 events across fourteen desks, ranked through their own web of trust and read once more without it as a control. Nothing on this page was chosen by us. Photographs remain on their authors' servers and are shown here by reference.