Alpen says AI identified Liquid’s $320M BTC exploit in an hour. Could a payout limit have stopped it?
Liquid’s federation released 3,996 BTC, worth about $320 million, after a flawed proof-verification cache allowed unbacked L-BTC to be accepted and a validly authorized peg-out to proceed. Alpen Labs CEO Simanta Gautam says AI agents reproduced the suspected flaw locally in about an hour, but only after the funds had left; production binaries and cache state were unavailable, so parts of the attack path remain inferred. SideSwap says its automated service lacked payout limits and approved the oversized withdrawal, while the federation signed after earlier payout attempts failed. Elements fixed cache-key encoding, added tests and released version 23.3.4. Liquid resumed ordinary transactions but kept peg-outs paused pending backing confirmation, software updates, testing and independent reviews. The incident highlights that validator fixes and independent payout controls address separate risks.
