Liquid Network Nears Full Recovery From Its Hack as Aqua Preps an AI-Coded Rewrite

Blockstream's Liquid Network is in the final stretch of recovering from the September hack that drained its federation wallet, and JAN3's Aqua wallet is using the downtime to prepare a full, AI-coded rewrite.

THE BUG THAT LET A HACKER PULL 4,000 BITCOIN FROM LIQUID

Samson Mow, CEO of JAN3 and a former Blockstream executive, walked through what actually happened on the show. A flaw in Elements, the software Liquid runs on, let a rare alignment of conditions produce unbacked L-BTC that was then pushed through a valid peg-out via SideSwap, a federation member holding a peg-out authorization key. No federation keys were compromised. The attacker withdrew close to 4,000 BTC, roughly 95 percent of Liquid's reserve at the time, then identified themselves on-chain as white hats within hours.

WHY 600 BITCOIN IS STILL MISSING

The attacker returned 3,400 BTC after negotiating with Blockstream, but kept roughly 600 BTC, treating it as a bounty it priced for itself rather than one it was offered. Mow said Blockstream told the hacker the funds belonged to Liquid users, not to Blockstream, and that the full amount had to come back. Talks broke down there, and the remaining coins have sat untouched since. Blockstream is covering the shortfall itself, restoring the federation wallet to full backing rather than passing the loss on to Liquid users. Peg-outs have been re-enabled, and Mow said the network is now almost completely back to normal: stablecoin transfers and tokenized real-world assets on Liquid kept functioning throughout, and the outage that mattered to ordinary users ran about four or five days before service was mostly restored.

AQUA'S REWRITE SWAPS CODE REVIEW FOR AI, AND ADDS A BITCOIN-BACKED CREDIT PRODUCT

Samson Mow was joined by Alex, the Aqua developer who built the wallet's current codebase, who described just how much AI coding tools have changed his own workflow in the year since Aqua was first written. A year ago, every line an AI model produced still needed his manual review and his own architectural decisions layered on top. On his current project, he said he no longer looks at the source code an AI model writes at all, as long as his tests pass. That shift is driving Aqua Neo, an internal rewrite set to ship as Aqua 1.0 within one to two weeks, according to Mow and Alex. The rewrite is built to support faster integration of new features, including a bridge that brings Strategy's STRC preferred stock, the Bitcoin-backed instrument Michael Saylor has called a digital credit instrument, onto the Aqua platform.

THE SAME WEEK'S AI CYBERATTACKS WEREN'T LOST ON EITHER OF THEM

Asked how he views AI-written code now that AI-orchestrated attacks have hit banks and governments in the same week, Alex argued the bigger risk isn't the AI, it's the decade of human-written software sitting underneath the modern internet that was never built to withstand this level of scrutiny. His read was that AI-generated code is already catching up to and in places surpassing legacy human code, and that the harder problem is auditing everything that came before it. Mow added that Bitcoin absorbed this pressure first, pointing to the Coldcard wallet exploit, a Lightning Network swap provider hit earlier this year, and now Liquid itself, and said he expects attacks elsewhere to get more deliberate as the easy targets get patched.

This story comes from the Simply Bitcoin Live show. Watch the full episode.