Blockstream CEO Adam Back stated that Liquid Network refreshed peg-out authorization keys, moved them to cold hardware wallets, and completed third-party security audits

Overview Debates Related claims Topics Sources

The THORChain solvency checker triggered an emergency pause halting Ethereum transaction signing within two minutes of detecting a vault shortfall

A March 17, 2021 firmware migration error caused Coinkite Coldcard devices to run seed generation on a software generator instead of hardware, producing weak recovery phrases

Using a 128-character passphrase on a Trezor device requires both the latest Trezor Suite app and updated device firmware, while older Trezor firmware retains a 50-character limit

Attackers reconstructed weak Coldcard recovery phrases to access wallets, but users with strong, unique passphrases were protected from the Coldcard attacks

Galaxy Digital's Alex Thorn estimated that the Coldcard seed vulnerability resulted in over 1,596 BTC stolen across roughly 7,300 addresses, totaling over $100 million in losses

Trezor stated that increasing Trezor's passphrase length was prompted by user inquiries following the July 2026 Coldcard seed generation flaw

A September 6, 2026 exploit of the Liquid Network reduced the Liquid Federation's Bitcoin reserves from about 4,205 BTC to 197 BTC

The Liquid Federation did not disclose in its official announcement who supplied the bitcoin needed to close the 600 BTC reserve shortfall caused by the September 6, 2026 exploit

The Liquid Federation announced on November 3, 2026 that it fully restored 1:1 Bitcoin reserves to back all LBTC tokens following a September 6, 2026 exploit of the Liquid Network

The Liquid Network public dashboard on November 3, 2026 showed 4,270.54 BTC held in reserve matching 4,270.54 BTC pegged into LBTC

An attacker who exploited the Liquid Network on September 6, 2026 routed unbacked LBTC tokens through SideSwap's peg-out service to withdraw actual bitcoin from the Liquid Federation's reserve wallet

An attacker who exploited the Liquid Network on September 6, 2026 returned 3,400 BTC the following day but retained around 598 BTC, demanding a 10% bug bounty that Blockstream refused

Liquid Federation board member Samson Mow stated Blockstream supplied 600 BTC for a deficit from the September 6, 2026 Liquid Network exploit, tracking 50 BTC sent October 28, 2026, and 300 BTC and 250 BTC sent November 2, 2026

A September 6, 2026 exploit of the Liquid Network occurred in Elements software because a cache key omitted the asset commitment and scriptPubKey, allowing invalid rangeproof checks to be reused

Trezor warned in August 2026 that length alone does not guarantee entropy because automated cracking tools systematically test dictionary words, leaked passwords, and common patterns

Trezor designated Trezor's passphrase feature as an advanced feature and warned users that a mistyped or forgotten passphrase can result in lost funds

On August 2, 2026, X account BTC Sessions reported the first confirmed loss from the July 2026 Coldcard seed flaw thefts involving a device using a weak two-word passphrase

Coinkite advised that Coldcard wallets were vulnerable unless created with 50 independent dice rolls or protected by a strong, unique passphrase

Trezor stated in August 2026 that its own hardware wallets were unaffected by the July 2026 Coldcard seed generation flaw, but advised users to move wallets created on a Coldcard and restored on a Trezor

Trezor Model T, Safe 3, Safe 5, and Safe 7 hardware wallets support 128-character passphrases, whereas the Trezor Model One maintains a 50-character limit