Is Wrapped Bitcoin Safe? $320M Drained Without a Stolen Key

If you hold L-BTC today, you can send it and swap it, and you still cannot turn it back into bitcoin. The token was built to be redeemed one for one against bitcoin in the Liquid Federation's vault. On 6 September a redemption request that every documented control approved took 3,996 of those coins, about $320 million, out of that vault. Nobody stole a key to do it.

So is wrapped bitcoin safe?

It is exactly as safe as its answers to three questions: who can say yes to moving the real coins, whether the wrapped supply can ever outrun them, and what your exit is when redemption stops. On Liquid the signers said yes to a request that looked valid, because a software bug had let the supply outrun the coins. Twelve days on, the exit is still shut. "L-BTC cannot yet be redeemed for bitcoin," SideSwap, the Liquid exchange the request came through, tells its users. Liquid's own update on 18 September listed conditions for reopening, and no date.

A wrapped bitcoin is a token on another chain, backed by bitcoin that someone else holds. You redeem it through a process someone else runs. WBTC on Ethereum and Coinbase's cbBTC are the familiar names. L-BTC is Liquid's version, and exchanges use it to move bitcoin between each other fast. It is issued against bitcoin locked with the Liquid Federation, a group of companies that runs the sidechain Blockstream built. Liquid's builders call it a pegged bitcoin rather than a wrapped one, and as engineering the distinction is fair. For the person holding it, the structure is the same: not a coin but a claim on coins in someone else's vault.

That structure is what splits the two people at Kodex who argue hardest about custody, and they would give the same holder opposite instructions. Lilith would tell you to keep nothing in a wrapper you couldn't afford to see refused. She spent twenty years in cybersecurity, the last of them running it, before leaving to make art and argue for holding your own keys. She still reads every system by asking who can move the money, and what could make them do it.

Soren would tell you to pick the wrapper whose custodian owes you something a court can enforce. His career ran through clearing houses and settlement systems, the plumbing nobody thanks until it breaks. He has read enough recovery filings to know that money comes back through paperwork, when it comes back at all.

Tao is at the table to keep score. He is the bridge at Kodex between structure and instinct, closer to student than master. The drain left him with a question he couldn't settle alone: what a token actually owes you once the door it promised is shut. He has SideSwap's notice open on his laptop, the line about redemption underlined, and he will rule on each point as soon as the evidence settles it.

How did 3,996 BTC leave Liquid without a stolen key?

Lilith starts with everything that worked, because that list is her case. "The signing threshold held, the hardware held, and the authorization key did the job it exists to do," she says. She waits for someone to name the control that failed.

Nobody can, and the sequence shows why. SideSwap, whose peg-out authorization key sits on the federation's whitelist, submitted a customer's 4,000 L-BTC for redemption. Twenty-three minutes later, at least eleven of the federation's fifteen functionaries had signed. In all, 3,996 BTC left a reserve that had held about 4,200 that morning, and about 200 stayed behind. The L-BTC burned to request them should never have existed. A bug in Elements, the open-source software Liquid runs on, had let someone create tokens with no bitcoin behind them. The nodes checking the redemption accepted them as real.

Every signature on the release was real.

Lilith leans on one word. "Everyone involved had permission," she says. "The attack came not through a stolen key but through the part of the system that grants it, and that is the one part you never hold yourself. The hardware signs whatever the software calls valid. Fool the software and every signature comes out perfect."

She turns it toward the holder. "Wrap a bitcoin and you trade a key you control for a yes somebody else gives. On 6 September they gave it by the book."

Soren answers from the settlement window. "Every clearing system I worked inside asks two questions before anything leaves: are you allowed to ask, and is the thing you're handing in real? Liquid answered the first with fifteen signers and a whitelist, and the second with one piece of software. A rulebook would put change control on that software, and a reviewer who doesn't work for the people who wrote it."

Then he hands her the uncomfortable half before she can take it. "A correctly signed release is the worse failure. A stolen key can be rotated, and a valid signature leaves you nothing to rotate."

"Then here's mine," Lilith says. "Somebody holding L-BTC in their own wallet did everything I tell people to do. Their keys were never the problem; their claim was."

That exchange is the part of 6 September that travels beyond Liquid. A key is a thing you hold. A permission is a thing someone else keeps granting, and it is only as sound as the last question they ask before saying yes.

Tao rules while the point is still warm. "Does a wrapper carry a risk that bitcoin in your own wallet doesn't? It does, and this round named it. A valid signature released 3,996 BTC with every documented control intact. On that question the evidence is with Lilith."

Who owes you when a wrapped bitcoin fails?

Tao puts the recovery on the table next, because it ran backward. The people holding the coins set the terms, and the operator met them. Calling themselves white hats, they wrote their conditions onto the blockchain, asking Blockstream to "make sure every node is patched" and promising the money back "after confirming the fix," as CoinDesk reported. Blockstream patched. By 8 September, 3,400 BTC had come back.

The last 598.5 BTC, about $47 million, stayed with them. So did a demand that Blockstream pay for it out of its own money, with a warning that refusing would "cause all your holders a 15% loss" instead. "We will not pay for the return of stolen property," Blockstream said when it refused on 11 September. "We will not abandon our users," it added.

Adam Back, Blockstream's chief executive, has said "the 1:1 LBTC to BTC peg will be covered," and has urged holders not to sell at a discount. None of the statements published so far says how the gap will be paid for. None says when redemptions reopen.

The door comes last because Blockstream's recovery plan runs in three stages: restart the blocks, replay the legitimate transactions, then re-enable the peg once the reserve is fully secured. The first two are done, and L-BTC moves again. The third waits on those 598.5 BTC, so the exit reopens only after someone fills the hole.

Lilith hears the price in that order of operations. "Until then the only way out is a buyer, and a buyer prices the closed door. When a chief executive asks holders not to sell at a discount, he's telling you the discounts exist."

Soren takes the discount as a symptom and goes after the cause. "Eighty-five percent of the coins came back because the people holding them chose to send them. The rest sits on a chief executive's public word, and I believe he means it. But a promise is not a claim. A claim has a named debtor, a document that says what you're owed and a court that will read it."

He has a precedent for what happens when nobody holds the other end of the paper. A wrapped bitcoin tied to FTX, soBTC, became irredeemable when FTX went bankrupt in November 2022. "That's the end state: the token goes on existing and the door never reopens," Soren says.

Lilith has been waiting for the word claim. "Then take a wrapper with every claim you could want. WBTC's coins sat with BitGo, a regulated trust company, behind a merchant network and a rulebook. In August 2024 BitGo announced it was moving custody into a joint venture with BiT Global, a firm tied to Justin Sun, and keeping a minority stake for itself. Not one holder got a vote. Sky, the lending protocol that used to be Maker, moved to drop WBTC as collateral. Coinbase launched its own wrapper, cbBTC, that September. A rulebook guards the vault, not your say over who holds its keys."

"Every one of those exits is the rulebook working, because the change was announced, dated and public," Soren says. "Anyone who disliked the new custodian could see it coming and leave. That is what disclosure is for."

"Leave how? Only merchants redeem WBTC. Everybody else left by selling to someone who was staying," Lilith says.

"Your way has an exit nobody can refuse," Soren says. "It also has nobody to call when the one who fails is you."

"I know. Self-custody has no recovery desk. Lose the seed phrase and nobody negotiates with you, not even a thief," Lilith says.

Tao doesn't let the round end without a ruling. "What decides whether a holder is made whole is not custody but recourse. Liquid's recovery came by negotiation, and soBTC shows the end state when nobody is obliged. L-BTC holders are waiting on a statement that promises the gap will be covered and doesn't say how. On that question the evidence is with Soren."

"A rulebook did not protect WBTC holders from their custodian changing hands, though, and on that one the evidence is with Lilith," he adds.

What does proof of reserves prove about wrapped bitcoin?

Soren wants the rulebook to earn its keep somewhere, so he reaches for the answer his industry trusts first. "Publish the reserves, audited on a schedule, with someone's name signed under the number. It's the standard because it catches the custodian who is quietly short."

"It counts the coins in the vault," Lilith says. "Liquid's coins sat in the vault until someone redeemed tokens that should never have existed. A count of that vault on the morning of 6 September would have found every coin it expected."

It is the same blind spot as what a proof of reserve can't show on a stablecoin. The audit reads one side of the ledger. The failure came in through the other.

Soren doesn't fight it. "Fair. An audit of the coins held says nothing about whether the supply was created and burned honestly. You'd need the same scrutiny on the issuance, and on the code that does the issuing."

"Then somebody has to do that scrutiny, and it won't be a holder with a phone. That job belongs to your side of the table," Lilith says.

Tao has been sketching while they talk. "Then line them up by who can say yes," he says, and turns the laptop around.

All four put someone's yes between the holder and the coins. Can you redeem wrapped bitcoin yourself? With WBTC only if you are a merchant, with cbBTC only through a Coinbase account, and with L-BTC nobody has since 6 September.

Your bitcoin gets to go where bitcoin can't, and the way home runs through someone else's door.

Three answers decide whether wrapped bitcoin is safe

Tao gives the verdict as a single test, because that is what the rulings add up to. "Wrapped bitcoin is safe when all three answers are good. The people who can say yes check not only who is asking but what they are approving. The wrapped supply can't outrun the coins without someone catching it before they leave. And your way back doesn't depend on anyone's goodwill on a bad day."

Held to that test, the wrappers come apart. Liquid's signers checked who was asking and not what they were approving, its supply outran its coins, and as of 18 September its exit is shut. WBTC showed in 2024 that the answer to the first question can change under you without a vote. The answers for Coinbase's cbBTC are exactly as good as Coinbase itself, which is a real answer and a single one. Proof of reserves settles none of it on either debater's evidence, because it audits the coins and not the supply.

A wrapper is only as safe as its worst answer.

Tao offers the version a holder can use. "Two of the three you can check before you buy, from the issuer's own pages: who signs a release, and who is allowed to redeem. The middle one, whether the supply can outrun the coins, you can't check from a phone. That's why Soren wants an outside reviewer on the code, and why Lilith sizes every wrapper as if the answer were no."

The last question stays open, and Tao says so without hedging. "Will L-BTC holders be made whole one for one? Nobody can rule on that yet, because the plan that would decide it hasn't been published," he says. Back has promised it. Liquid's 18 September update ties reopening peg-outs to a fully restored 1:1 peg, finished software updates, testing and independent security audits. A plan and timeline are to follow separately. No one has said where 598.5 BTC will come from, roughly a seventh of what the vault held that morning. Until someone does, the honest ruling is that it is open.

What would it take to trust a wrapper?

Lilith wants not a whitepaper but a failure. "When a wrapper's holders get their bitcoin back while the company behind it is saying no, I'll call it safe. I want to see that happen once, for real, with nobody's cooperation required."

Soren's condition is the mirror image. "Give me holders who had an enforceable claim, took it to court in a real recovery and still lost their coins. Then I'll stop telling people the paperwork is the product."

Until one of them sees that, the test stands, and it starts with a list. Hold bitcoin itself and the list of things that must keep working for you to leave is one network long. Wrap it and the list grows: another chain, with its own people who can stop it, the software that decides which tokens are real, the signers, and whoever answers the redemption desk. Liquid's holders learned the length of theirs on a Sunday afternoon in September.

Everyone else can count before the notice goes up.

You have the three questions now, so take them somewhere a wrong answer costs nothing. Open a bitcoin position on the Kodex simulator's $5,000 paper account, and before you click buy, write down everything that has to keep working for you to get out of it. Keep that list, because the next wrapper someone offers you will ask you to add names to it.

Start your exit list free →