Nobody broke the cryptography. Somebody found a way to make a node skip it.

On Sunday 6 September, around 14:00 UTC, mid morning on the US east coast, an attacker primed a cache with two setup transactions, submitted one inflation transaction, and pegged out. CertiK puts the total at 3,998.5 L-BTC, about $318.7 million at the time. A single transaction of 3,996 BTC landed at a Bitcoin address with a message attached: we are whitehats, contact us on chain. The federation wallet was left holding 197 BTC.

Liquid is Blockstream's Bitcoin sidechain. Its token, L-BTC, is supposed to be backed one for one by real bitcoin held by a federation of exchanges and infrastructure firms. The attacker produced L-BTC that was backed by nothing and redeemed it for the real thing.

The mechanism is a serialisation bug, which is worth sitting with, because it is not the kind of failure anybody insures against. Every node keeps a cache of rangeproofs it has already verified, since verifying them is expensive. The key for that cache was built by gluing four values into one hash: the proof, a commitment, an asset generator and a script. In CertiK's description the four were concatenated "without encoding their lengths." Two of the four vary in length and sit at opposite ends. So, in their words, "distinct tuples can produce the same byte stream by moving bytes across field boundaries."

Put plainly: the same run of bytes can be cut apart two different ways and produce the same key. Show a node a valid proof once, then present a different, invalid one that cuts to that key, and the cache answers already verified without looking. The rangeproof math was never touched.

The response was fast, and we want to be precise about it because it would be easy to get backwards. Pull request 1600, by a Blockstream engineer, hardens the cache key so the encoding cannot be ambiguous and adds a switch to turn the cache off entirely. It was opened at 17:19 UTC on 8 September, reviewed three times by Blockstream's director of research, and merged one hour and forty seven minutes later. A tagged build, elements-23.3.4, went out at 03:14 UTC on Wednesday, flagged as a prerelease.

There is a second pull request, 1601, filed seventeen minutes after the real one by a developer with no affiliation to the project, proposing a narrower version of the same idea. It sits unmerged with no review comments. It is easy to mistake for the fix and it is not the fix, and anybody citing its emptiness as evidence that nobody was paying attention has the story exactly inverted.

What is genuinely open is what was running before Sunday. Several outlets report that a related caching patch sat public in the Elements repository for days before the attack with no release tag carrying it, and infer that the attacker read it and worked backwards. CertiK stops short. It notes the exploit's construction "specifically matches the four-field, undelimited key introduced by the patch," then says plainly that "the exact binaries deployed on individual functionaries have not been published." Nobody outside the federation can currently say which code was running on which node. We are flagging that inference rather than repeating it as fact.

What happened next is stranger than the theft. On Monday the attackers sent back 3,400 BTC, roughly $272 million, about 85% of what they took. They kept 598.5 BTC, roughly $47 million, apparently as a self-assigned bounty, and asked on chain whether that was acceptable.

As of early Wednesday the chain is still paused. The last Liquid block was mined Monday at 04:49 UTC, on a network that normally produces one every sixty seconds. Blockstream says the bridge nodes are patched and that federation members are preparing a coordinated restart, without naming a date or terms. Exchanges have not resumed L-BTC deposits or withdrawals, and redemptions are halted.

Now the part most coverage blurred. This was not Bitcoin. Liquid is a federated sidechain with its own software and its own trust model, and the bug was in Elements, not Bitcoin Core. Rangeproofs do not exist in Bitcoin Core. Bitcoin's consensus was never at risk and no bitcoin was created out of nothing on the main chain. What failed is the thing sidechains are sold as being, a way to borrow Bitcoin's assurances somewhere faster and cheaper. You do not get Bitcoin's assurances. You get the assurances of whoever wrote the bridge, and this week that came down to a hash with no delimiters in it.

Three metrics.

Metric 1, Fear and Greed: 66. Greed, per alternative.me, stamped 9 September, down from 69 on Tuesday and the 71 we printed Monday. Bitcoin was $78,600 on Tuesday evening, off about 0.4% on the day and below the $80,050 we published Monday. Greed registering on a falling price is what a sentiment gauge looks like when it is measuring the last fortnight, not the last two sessions.

Metric 2, ETF flows: September stands at about $770 million, across four trading days. The prints are minus $236.5 million on 1 September, plus $101.1 million on the 2nd, plus $730.9 million on the 3rd and plus $174.6 million on the 4th. That is the whole month so far. Monday was Labor Day and the exchanges were shut, and Tuesday's print had not published when this was written, so we are not estimating it. Our 7 October test on September's monthly total tracks Branch A on that figure, and next week's issue carries the verified prints.

Metric 3, BTC dominance: 58.4%. Down from the 59.2% we published Monday, on CoinGecko's global measure, against a total crypto market around $2.70 trillion. Dominance fell for the ordinary reason: bitcoin gave ground and the rest gave less. Two sessions is not a rotation, and we will say so again next week if it is still two sessions.

The book is flat again, for the eleventh issue running, and the STACK says exactly what would change that and by how much.

📣 THIS SPOT IS OPEN

Baseline Crypto reaches nearly 7,000 Bitcoin-focused readers every Monday and Wednesday morning, opening just under half of what we send. Direct sponsor placements are open, premium position, top of the issue, one per send.

Reply to this email for rates.

The steelman is strong and we hold most of it. The flaw is in what the number is measured against.

Take the position seriously first. High yield OAS is the best calibrated stress instrument in finance. It is priced continuously by people with real money at risk, it went to 20% in 2008 and 10% in March 2020, and it has led equities into every serious credit event of the modern era. It is not a survey. Anyone who spent the last three years shorting liquidity plumbing while spreads ground tighter has lost money doing it. If you had to pick one number to tell you whether the financial system is in trouble, this is a defensible pick, and it is currently saying no.

Here is the structural problem.

OAS is a spread. It is the extra yield over Treasuries, which means the Treasury curve is the ruler, not the thing being measured. If a funding shift distorts the front end of that curve, both legs move together and the difference between them can sit perfectly still while the thing underneath moves a great deal. A spread is silent about its own yardstick by construction. You cannot use it to detect a problem in its own denominator.

Now the incentives, which is where this gets uncomfortable.

Ask who marks these bonds and what they are paid for. High yield credit is overwhelmingly held by funds benchmarked to a spread index, and the person running that book is compensated on carry: the coupon collected while nothing happens. Carry pays every single day right up until the day it does not, and then it gives back years in a week. That is not a criticism of anybody's character. It is the shape of the payoff. A manager who widens their own marks early underperforms the index for four quarters and then explains it to an allocator who has already left.

The other half is mechanical. Most of what sets the level is not a human forming a view at all. Index inclusion, dealer marks against evaluated pricing and passive credit ETF flows do much of the work, and none of those processes contains a step where somebody reads the Daily Treasury Statement. The number is genuinely well calibrated to default risk. It was never designed to be a liquidity sensor, and we keep asking it to be one.

So we are not saying credit is wrong. We are saying credit answers a different question than the one people quote it for, and that a market which prices default probability beautifully can be structurally blind to a funding change until that funding change becomes a default probability. Those are two events with a lag between them.

Which is why this belongs in a dated test.

New dated test, grades in the Wednesday 7 October issue. The published number is the ICE BofA US High Yield Index Option-Adjusted Spread, FRED series BAMLH0A0HYM2, value published for 30 September 2026.

Branch A: 3.00% or above. Branch B: 2.70% up to but not including 3.00%. Branch C: 2.40% up to but not including 2.70%. Branch D: below 2.40%.

One published series, one date, four ranges, no gaps and nothing outside them. The 7 September value of 2.68%, the latest FRED has posted, sits in Branch C. That is deliberately not the flattering setup: Branch A is the branch our own argument implies and it is 32 basis points away.

One thing this test does not replace. On 2 September we published a separate commitment, that if spreads were at or inside 2.70% when the Treasury cash balance peaks in late October, our framing was wrong and we would say so in those words. That still stands on its own date. The new test grades a month earlier, on 30 September, and grading Branch C then is not the same as being let off the October commitment. Both are on the record and we will answer both.

Three numbers that define the next three weeks.

598.5 BTC, the number that decides whether this week was a theft or a negotiation. That is what the Liquid attackers kept after returning 3,400, and it is roughly $47 million. There is no precedent that settles it. If it comes back, the white hat framing survives and the federation gets to call the whole thing an expensive audit. If it does not, a group took $47 million from a Bitcoin sidechain, announced the amount, and kept it while everyone waited politely. Watch the restart terms as closely as the balance: a federation that resumes without recovering the rest has priced what a broken bridge costs, in public, for every other bridge to read.

3.00%, the level that puts us back on the board. This is the high yield OAS trigger we have published in every issue since 2 September. The series is at 2.68% as of 7 September, so it is 32 basis points away. Be clear about the direction, because it is not flattering to us: over the last thirty days the spread has tightened by two basis points, from 2.70%, so it is moving away from our trigger rather than toward it. The gap has widened from 30 to 32 basis points while we have been waiting. This is also the Branch A line on the new dated test, so one number decides both whether we trade and whether we grade ourselves right.

Block 967,680, the next difficulty retarget, due around 19 September. The estimate is under plus 2% and sliding, from above 6% when we set a dated test on it two days ago, and it has fallen every day this week as hashrate has come off. The epoch is roughly a quarter mined and the previous retarget came in at plus 1.31%. Treat any estimate at this stage as provisional: it recomputes every block, and it moved a third of a percentage point in the fifteen minutes it took to check it. That is exactly why our test has three ranges rather than a point.

Forget analyst predictions. Polymarket is a real-money prediction market, where traders put actual dollars on outcomes. Scorecard first, then the board. Not financial advice. Our read. Disclosure: we hold personal positions in Polymarket itself and may earn a commission from Polymarket referrals. These markets are thin and the odds below move, so read direction over ticks.

Scorecard: the book is flat for the eleventh consecutive issue.

The only entry condition on the board is high yield OAS widening through 3.00% into the late October Treasury cash peak. It is at 2.68%, 32 basis points away, and over the last month it has moved two basis points in the wrong direction. The book is flat because the level has not printed, and that is the entire reason.

We are not going to dress that up as discipline. A permanently flat book turns a scorecard into theatre, and eleven issues is well past that point. A published entry condition that never triggers costs a reader nothing and teaches them nothing. The one thing it buys is that the condition was stated in advance, in public, with a number on it, and you can check whether we honour it the day it prints. That is worth something. It is not worth eleven issues.

One correction to our own framing while we are here. This trigger has run in three issues, not eleven, since we first published it on 2 September. And on 26 August we wrote that credit "was right and we were wrong" about spreads. We have since caught ourselves describing that as having been early. It was not. It was wrong, and the record says so.

A correction we are restating rather than letting it scroll away. On CLARITY we entered at 41% and exited on our published cloture rule at roughly 33 to 37%. That is a realized loss and the ledger carries it as one. The 2 September issue described 41% as the exit price, which quietly turned a loss into a clean trade. Monday's issue corrected it. We are saying it again because a correction that runs once and disappears is not a correction.

And the follow up we promised on Monday. We said we would tell you whether anybody had reviewed pull request 2273, the defect report against the post quantum work in the Bitcoin BIPs repository. Six days open, last touched two minutes after it was filed, zero review comments. Worth holding that against the Elements fix in today's lead, which was reviewed and merged inside two hours. Same week, same broad ecosystem, opposite response.

Three dated tests are open and none grades today. September's spot ETF monthly total grades 7 October, tracking Branch A at about plus $770 million through four sessions. The 30 September Treasury cash close grades 5 October, with Branch C live at $888.9 billion. And the difficulty test has moved, which is the real update.

The difficulty test has shifted branch and we are flagging it now rather than on 21 September. When we set it on Monday the estimated change at block 967,680 was above plus 6%, comfortably inside Branch A at 4.00% or more. It is now under plus 2%. That moves our tracking to Branch B, 0.00% up to but not including plus 4.00%. Nothing has resolved and the epoch is only a quarter mined. But we set a test at a level that looked safe, it is no longer safe, and that is exactly what a newsletter is tempted to mention quietly at grading time instead.

Fed decision in September, 25 bps increase | Market: 53.5% ⚪ NO TRADE, and it is no longer a coin flip
No change is 46.5%. The event has drawn $104.9 million across all five outcomes, of which the hike leg itself is about $19 million. On Monday we quoted this at 49.5% and called it a genuine coin flip. It has since sat above even money, though it has crossed and re-crossed 50% six times in ten days, so treat the exact level as perishable and the direction as the point. In August this leg traded in the twenties and low thirties. We stay out because our published rule for entering was a move back under 40% with the Fed's stated position unchanged, and this went the other way. But it is the most consequential price on this board for anything you own, and the meeting is on the 16th.

CLARITY Act signed into law in 2026 | Market: 14.5% ⚫ EXITED at roughly 33 to 37%, re-entry conditions unmet
On $14.5 million of volume. The calendar is the story. The House returns on 14 September and its last voting day is the 17th. The Senate's cloture motion on the motion to proceed to H.R.3633 ripens Tuesday 15 September at 2:15 pm, filed but not yet voted. And the House calendar was revised to remove 22 to 25 and 28 to 30 September, which strips most of the month's remaining floor time. That is four House voting days between now and October for a bill that has to clear both chambers and be signed inside this calendar year. Our published re-entry has three legs, the merged text surviving markup and cloture with the contract still under 30%. Neither of the first two has happened. We stay out.

Zero Fed rate cuts in 2026 | Market: 92.95% ⚫ EXITED at 88.75%, and it has run four points further against us since
Our history here is the point. We shorted this at 78%, stopped out at 88.75% on a published risk rule, and recorded the loss. It is now 92.95%, so the exit was right and the original short was wrong, and both stay on the record. As a fresh position there is nothing here: the payoff is 7 cents against a 93 cent stake and we do not sell tail risk into an FOMC. What would make it interesting is a single print, CPI or payrolls, that drags this under 80%, which would mean the market pricing an actual pivot rather than a pause.

Track everything live at polymarket.com, free, no account required.

Monday we asked whether you would rather see the exposed P2PK coins frozen by consensus or left spendable by whoever gets there first. Nobody replied.

We are telling you that rather than describing a split that did not happen. It was a hard question asked at the end of a long issue, and the honest read is that it was interesting to us and not to you. Fair enough.

This week's is smaller and more concrete, and it comes out of noticing that the lead and the FILTER have the same shape.

In both cases a system was checked carefully where everyone looks and not checked at all where nobody does. Liquid's rangeproof cryptography was sound; the cache key that decided whether to run it was four fields glued together with no lengths encoded. High yield OAS is a beautifully calibrated measure of default risk; it is also measured against the very curve a funding shift would distort first.

One question: in the thing you own or run, what is the equivalent? Which part is trusted because it has never failed, rather than because somebody checked it?

The honest answer is usually boring and specific, and the boring specific ones are worth publishing. A cache key. A ruler. The step between the two things everybody audits.

The uncomfortable footnote is that credit has been right and we have been wrong about it before, in print, on 26 August. Treat our version of this with the scepticism that has earned.

Hit reply. We read every response, and the best calls run Monday.

See you Monday, with the FOMC a day out and the September hike now the majority price, the first verified post-holiday ETF prints, and whether Liquid has restarted or is still asking the people holding $47 million to send it back.

The Baseline Crypto Team

Three tools we built for ourselves and could not find anywhere else. Free, no signup, no accounts, and nothing you type ever leaves your browser.

Is your hardware wallet screwed? Check your device and firmware against every logged advisory, including the ones where updating your firmware does not save you, since the seed itself is already weak.

How fragile is your self-custody? Nine questions, scored out of 27. Every question exists because of a documented loss.

Our track record, losses included. The public ledger of every dated call, carrying the CLARITY loss at its real exit price. The page is running four weeks behind and we are fixing that, so today the STACK above is the live record and the page is the archive.

Somebody you know holds coins on a sidechain, a bridge, or a wrapper that promises bitcoin without being bitcoin. This is the week to send them the wallet check and ask what actually backs the thing they hold. Liquid's federation is a named list of real companies with real reputations, it patched and shipped a fix inside two hours, and it still lost $320 million on a Sunday morning to a hash with no delimiters in it.