The views expressed in this article are those of the author and do not necessarily reflect the position of CoinGeek.
The premise
On September 6, 2026, a bug in Blockstream’s Elements node let somebody mint about 3,998.5 L-BTC from nothing and peg them out as 3,996 real BTC in 36 minutes. Most came back. About 598.5 BTC did not, and on September 11, Blockstream published a letter refusing the “bug bounty” and promising to work with law enforcement, exchanges, and forensic specialists to get the coins back. Four days later, Samson Mow told X that “code isn’t law” and never was. He is right, and that is the pitch: the builders of BTC’s flagship sidechain have conceded, in writing, that law governs the coins. The only thing they have not built is the mechanism that lets a chain obey a court.
BSV built it based on some old Satoshi code and some old Satoshi posts…
The argument
At 13:53 UTC on September 6, Liquid block 4,050,336, somebody used a range-proof cache bug in Blockstream’s Elements software to mint roughly 3,998.5 L-BTC with no bitcoin behind them, and 13 minutes later they handed 4,000 L-BTC to SideSwap’s peg-out service. By 14:28, the Federation’s 11-of-15 multisig had paid 3,996.018 BTC, about $320 million, to the attacker. The fix had been merged two days earlier, and nobody had shipped it. Liquid’s incident report, with a straight face: “The peg-out mechanism that authorizes withdrawals to whitelisted addresses operated as designed.”
That evening, the thief posted an OP_RETURN reading “we are whitehats. contact us on chain,” and Blockstream negotiated on chain like a hostage team working a payphone. By September 7, 3,400 BTC were home. About 598.5 BTC ($47 million) were not, and a second OP_RETURN explained why: “You SHALL pay 10% using your own money as bug bounty.”
Mow, September 8: “I believe the hacker will return all of the funds.” Eight days later, 598.5 BTC say otherwise…
Blockstream’s September 11 letter answered like a district attorney. “Taking assets without authorization and withholding their return is a crime, not responsible disclosure. It is not white-hat activity. It is theft.” The letter also names who does the enforcing: “We will work with law enforcement, exchanges, service providers, forensic specialists, and other relevant parties to trace and recover the assets and identify those responsible.”
The hard money company, full of guys who claim to want to separate money from government, is calling the cops.
Samson is right
On September 15, a user posting as @btc_jefferson asked Samson Mow, the JAN3 chief who has been posting the Liquid Federation’s updates all month, “So code is still law or not? @Excellion or it’s only law if it benefits you?” Mow’s answer, in full:
The reply came back within three minutes: “Wow. I don’t expect to hear it from you or Adam Back who repeatedly said code is law. Now that you got hacked because your code allows peg-out, all of sudden it’s not law.” And Mow, five minutes after his first answer:
Correct! “Code is law” was a DAO-Hack-era t-shirt, and Satoshi wrote a specification for cash, not a manifesto for outlaws. Nobody needs to find Samson a quote because we agree with him, and so, as of September 11, does Blockstream’s legal department.
We are strange bedfellows, admittedly…
But if code is not law, then law is law, and law has to reach the chain somehow. So, who moves the coins when a judge says move them? On BTC, nobody. On Liquid, as of September 2026, Blockstream, by hand, with a letter.
Two worlds
World one is the one Satoshi Nakamoto described on BitcoinTalk on August 11, 2010, in a thread about escrow: “Imagine if gold turned to lead when stolen. If the thief gives it back, it turns to gold again.” A court says the coins are stolen and they turn to lead; the court says who owns them and they turn back to gold. Boring. Bankable. It is the world every one of Mifiel’s promissory notes and Stokr’s securities already lives in, because a pagaré is a legal instrument with or without a sidechain under it. Mow said so himself on September 10:
Five billion dollars of paper that a court can already void does not want a chain that cannot follow the court.
World two: Road Warrior. I want to give it its best case, because it has one. The key is the deed; every exploit is final, no actor is privileged, no court can capture the ledger, and a chain nobody can freeze is a chain nobody can freeze for the wrong reasons either.
It also means 598.5 BTC now belong to whoever typed “we are whitehats,” and everybody else gets to write letters and wring their hands while BTC’s faithful have to deal with the still-stinging Coldcard hack and the fallout from people asking what happened between Adam “Andy” Back and Jeffrey Epstein that made Jeff say he “liked him.”
Here is the rub, dear reader: Liquid never lived there. Fifteen incorporated companies known to each other hold the 11-of-15, which is a consortium in every language except marketing. Peg-outs only reach addresses whitelisted under a PAK. Every peg-in UTXO carries a 28-day timelock behind which sit 2-of-3 emergency keys in Blockstream’s cold storage, refreshed constantly so the backdoor never opens (in June 2020, one 870-BTC UTXO’s timelock lapsed for 40 minutes). On September 6, the Federation switched the bridge nodes off: “Effectively, the Liquid sidechain is paused until this issue is resolved.” And on September 10, Adam Back said the 1:1 peg would “be covered,” which means somebody with a balance sheet eats the 598.5 BTC hole, and that “somebody” is a company, not a protocol.
A chain you can pause by hand and backstop with a corporate balance sheet is world one with the paperwork missing. Sorry, Mad Max, we ain’t doing Road Warrior mode when everyone has to put on their big boy pants.
The mechanism already exists
Digital Asset Recovery on BSV is that “paperwork.”
A plaintiff gets a court order, valid under the law of the relevant jurisdiction, and a notary, acting like a bailiff, converts it to machine-readable form and broadcasts it through the Blacklist Manager, at which point nodes freeze the named outputs. On a further order, a recovery transaction reassigns the funds to their rightful owner. The spec puts it in one line: “A transaction or block that spends a consensus-frozen output is invalid.”
No private key. No haircut. No letter.
None of that is radical, because nodes agreeing on a state, and that state being the truth, is all a blockchain ever was for. DAR adds a coordination mechanism and the social courage to admit that a court order is an input. The Blacklist Manager shipped in January 2023, the Network Access Rules followed in 2024, the code is open, and Blockstream could run it tomorrow.
Satoshi’s own kill switch
On August 15, 2010, a transaction in block 74,638 created about 184 billion BTC, and Satoshi shipped a fix within hours so the network reorganized onto a chain in which that transaction never happened. The largest counterfeit in Bitcoin’s history was reversed by a coordinated upgrade, not by a private key, and the same release, 0.3.10, added the alert system: one signed key, and a valid alert could drop every node into safe mode.
In March 2013, the 0.8 database fork, developers used that channel to ask pools to abandon the longer chain, and the miners did it.
Confirmed transactions were orphaned by social decision.
BTC retired the key in 2016 and 2017 and published it in 2018, with the stated reason that “The holders of the singular Alert Key can at any time send an alert which could affect the entire network.”
Yes. That was the point!
Anything calling itself Bitcoin has to own that history, and BSV kept the channel and taught it to carry court orders when a victim can prove beyond doubt that they have been robbed of their bitcoin.
Luke, the one-man alert key
Which brings us to the man who left “Spamcoin” for purity, and has a long history with Blockstream that everyone should consider on this issue, too.
On August 29, Luke Dashjr posted: “PSA: Potential Bitcoin PoW change Sunday. SHA2 miners should stop mining Saturday.” And: “After NYPost updates their Sunday morning print online, I’ll post the canonical blake2b_headline parameter.” One man picks the genesis parameter off a tabloid front page, sets the schedule and, on September 5, hands down the verdict: “BLAKE2b was a true hardfork with consensus.”
Consensus of whom?
No major exchange has listed it. That is an alert key with none of the accountability of a court. Heck of a decentralization from the guy worried about the sovereignty of independent node operators!
Now, let’s talk about the bankers. September 3: “It’s also possible (IMO likely in many cases) they are in on a conspiracy to suppress Bitcoin and replace it with a fiat CBDC (Spamcoin).” September 12: “It is literally worse than fiat.” Fine. Take him at his word. Then BTC is the coin of exchange-traded funds (ETFs), treasuries, and custodians, and those customers hold assets on one condition, which is that a court can give them back.
Their coin should give them what they are paying for.
‘Return the bitcoin’
The mockery of “code is law” is complete. The people who spent a decade sneering at it are drafting letters to law enforcement and writing “Bitcoin is hard money and can’t be minted without costs” five days after someone minted 3,998.5 of it for the price of a cache bug and likely a $200/month Claude account.
Those 598.5 BTC turned to lead the second they were minted from nothing, and the only open question is who has the authority to turn them back into gold.
Recoverable property is less a bug in Bitcoin than the feature that makes tokenized assets and a $5 billion book of promissory notes possible at all, and only one chain had the courage to write the court into consensus.
Blockstream’s letter ends “Return the bitcoin.” The software that does that is open, running, and yours to fork, Adam and friends.
Come get it.
This opinion piece is published to encourage discussion. The author’s views are their own and do not constitute legal, procurement, or policy advice, nor do they represent the positions of CoinGeek or its partners.
Watch | Blockchain Futurist 2025 (Part 2): From hype to real use cases
Be the first to comment