Bitcoin Brief

Sup, freaks.

This Liquid story is absolutely insane. A bug created fake L-BTC, the federation signed away 3,996 real BTC, and Blockstream is now negotiating with the party holding it through messages embedded in Bitcoin transactions. You cannot make this stuff up.

LEAD STORY

Liquid's 3,996 BTC Peg-Out Turns Into an On-Chain Negotiation

Liquid is still frozen at block 4,051,232. The bug created roughly 4,000 L-BTC out of thin air and Liquid's federation signed a payout of exactly 3,996.01834922 BTC. The bitcoin has not come back. It is sitting under the control of the party calling itself a group of whitehats.

The recovery negotiation is now playing out in public through Bitcoin transactions.

On Sunday, the party holding the bitcoin announced itself on chain: “we are whitehats. contact us on chain.” Blockstream asked it to email its security team, then sent a signed and encrypted message through another OP_RETURN.

The self-described whitehats kept the conversation on chain. They asked whether they should send most of the bitcoin to a specific return address, then told Blockstream to patch every node first. They said the chain was still at risk and attached encrypted technical details.

Blockstream replied “Yes, thank you” in a signed message. At 5:41 a.m. ET it sent another PGP-signed OP_RETURN saying the bridge nodes were patched and the funds were safe to return.

The bitcoin is still sitting there. At 8:43 a.m. ET, the holder swept 74 UTXOs into a fresh output, sent 1,000 sats to the proposed return address and asked Blockstream to confirm the destination again. The new 3,998.499 BTC output contains the 3,996.01834922 BTC federation payout, 2.49749857 BTC from somewhere else, and the dust that piled up as people joined the conversation.

At first glance, this looks ridiculous. Nearly 4,000 BTC is hanging in limbo while two sides pass notes through OP_RETURN. The more I think about it, though, the more the channel makes sense if the party on the other side really intends to return the funds without revealing its identity. Email means providers, accounts, IP logs, subpoenas and a fresh pile of third parties. Bitcoin gives both sides a public clock and PGP proves which messages came from Blockstream. Encryption handles the details they do not want the world to see.

I still have no idea whether the people on the other side deserve to be called whitehats. They chose that label. The bitcoin will tell us whether they earned it.

SideSwap says a customer brought roughly 4,000 L-BTC through its normal peg-out flow after those coins had been created with an Elements vulnerability. SideSwap says its own systems and PAK were not compromised. Six Liquid inputs requested the 3,996.01834922 L-BTC withdrawal, and Liquid's 11-of-15 federation signed the matching Bitcoin transaction.

Bitcoin worked. Liquid failed.

The network settled a transaction carrying enough valid federation signatures. The broken pieces were Elements validation, Liquid's bridge controls and the process that allowed fake L-BTC to become real bitcoin leaving the federation wallet. A fix appears to have landed in Elements before the incident became public, but we still do not have a full postmortem explaining the bug, the exploit window, the validation gap or who knew what when.

Liquid remains paused. The 3,996.01834922 BTC remains in the output controlled by the self-described whitehats. Blockstream says the bridge is patched. The holder wants one more confirmation. Until the money moves back and the network comes online safely, this thing is not over.

SIGNAL

Japan's Yen Defense May Have Required Treasury Sales

Japan may have just given us a preview of what happens when a major creditor has to defend its own currency. Its foreign securities reserves fell by $87.8 billion in August, right next to the ¥15.4 trillion, or roughly $98.6 billion, Tokyo spent supporting the yen through August 26. Japan's total official reserves fell $79.6 billion to $1.208 trillion.

We do not have a line item showing exactly what Tokyo sold. The numbers strongly suggest Treasuries were part of it. Japan is the largest foreign holder of U.S. government debt, so this matters. If the yen forces Tokyo to sell bonds instead of buying them, America's funding problem gets a little harder. Japan still has plenty of reserves and could ask the Fed to use the FIMA repo facility. Either way, a weak yen is no longer Japan's problem alone.

El Salvador's AI Education Strategy Is an Overwhelming Success

PISA for Schools reported that 1,198 volunteer students across 171 public schools scored above El Salvador's national average in reading, math and science. Their results were comparable to Germany and Sweden's 2022 averages. President Nayib Bukele says the program uses AI tutors and has already expanded to more than 1,000 schools.

I find this incredibly impressive. Bukele did not assemble a committee to spend five years wondering whether AI belongs in a classroom. El Salvador put the tools in front of students and went to work. When I sat down with Stella from Alpha School in Austin, she was 15 years old and had used AI to build Bibliarch, her own product. That conversation made the promise of this model feel real. Give kids useful tools, agency and time and they will surprise the hell out of you. El Salvador is now trying to prove that at the scale of a country.

The Delinquency Bucket Can Flatter the Headline

Bill Moreland of BankRegData sent over a good reminder about bank delinquency data: the cleanest number on the page can fool you. Under Call Report Schedule RC-N, a loan can sit 90 days past due and continue accruing interest if it is well secured and the bank believes it is collecting.

So where did the bad loan go when the 90-day bucket falls? Maybe the borrower caught up. Maybe it moved into nonaccrual. Maybe the bank is still counting interest because collateral should make it whole. You have to look at the whole migration: 30-to-89 days late, 90-plus and still accruing, nonaccrual, charge-offs and recoveries. A cleaner delinquency headline does not necessarily mean a cleaner loan book. Sometimes the mess simply moved one column to the right.

Analysis credited to Bill Moreland and BankRegData, used with permission.

JoinMarket-NG Removed a Mutable Update Trust Path

JoinMarket-NG 0.39.1 fixes one of those boring update paths that becomes very exciting the moment somebody compromises it. Until now, the updater pulled a fresh installer from the mutable main branch every time it ran. After this release, users can keep the installer locally and verify future installer signatures against trust anchors shipped inside it.

That is a much saner setup for software handling bitcoin and CoinJoin activity. You should not have to pray that a GitHub account, live branch and network connection are all clean at the exact moment you update your wallet. The release also fixes repeated rescans, false orderbook bans, leaked TCP transports and scan-coverage reporting. Verify this release carefully. Once you are across, future updates stop leaning on a live mutable installer.

Massachusetts Police Must Disclose Their Plate-Reader Footprint

Massachusetts State Police wanted to track cars across the state without telling citizens where the cameras were or how officers searched the database. A Suffolk Superior Court judge told them to turn over the locations and audit logs, with plate numbers redacted. The police tried to hide behind critical-infrastructure and active-investigation exemptions. The court did not buy it.

The cameras are not going away, unfortunately. At least the public can now see where they are and how they are being used. Massachusetts' highest court warned in 2020 that enough cameras in enough places can cross a constitutional line. Good luck challenging a surveillance dragnet when the police will not even show you the dragnet. Camera maps and search logs are the bare minimum.

ETF FLOW CHECK

U.S. spot bitcoin ETFs pulled in approximately $174.6 million on September 4, their third straight positive session after the September 1 outflow. The September 1 through September 4 net came to roughly $770.2 million, and IBIT supplied about 67.2% of Friday's total. Three green days do not tell us where bitcoin trades next, but $770 million is not nothing. The bid is there.

⚡ FREEDOM TECH CORNER

Specter DIY v1.10.5 Hardens Randomness, Change Verification and Builds

Specter DIY v1.10.5 shipped the kind of wallet work I love to see. It rejects a dead hardware random-number generator instead of pretending the output is entropy, verifies descriptor derivation before calling an output change, restores the mixed-input warning for transactions spanning multiple wallets, repairs reproducible builds and adds a formal security disclosure policy.

These are not glamorous fixes. They are the fixes that keep people from losing bitcoin. Bad entropy can destroy a key before the user ever sees an address. Fake change can send money straight to an attacker. A build nobody can reproduce asks users to trust the binary on faith. If your device is already on v1.10.3 or later, this is a firmware-only update. If you are on v1.9.0 or earlier, move to v1.10.3 first because that release rotated the bootloader signing keys.

DATA SNAPSHOT

As of September 7, 2026, approximately 10:13 a.m. ET

Sources: Coinbase for spot price; mempool.space for block, fee, hashrate, and difficulty data.

Stay humble. Stack sats.

YouTube: https://www.youtube.com/@TFTC

podcast: https://www.tftc.io/tag/podcasts/