Bitcoin bridges need mandatory withdrawal delays so a single software bug cannot become an instant catastrophe, says Rootstock co-founder Sergio Lerner — whose own network already enforces a 36-hour waiting period that would have stopped the kind of unauthorized peg-out that drained nearly 4,000 BTC from Liquid Network’s federation wallet.
By Marcus Johnson | September 10, 2026
The Hook: A Lesson Written in 4,000 Missing Bitcoins
In an interview with crypto.news, Sergio Lerner, chief scientist and co-founder of RootstockLabs, argued that immediate settlement — the very thing bridges advertise as a feature — is what turns a minor validation error into a total loss. His comments come after actors created unbacked L-BTC tokens and used SideSwap’s peg-out service to withdraw nearly 4,000 BTC from the Liquid Federation wallet. The federation paid out 3,996 BTC about 23 minutes after the request, according to the report, because the unbacked tokens could not be distinguished from legitimate ones.
The attackers, described by Liquid as purported white-hat hackers, later returned 3,400 BTC after Blockstream confirmed the affected bridge nodes had been patched. About 598 BTC remained outstanding, and Liquid had resumed block production without restoring peg operations as of September 10, according to the source report.
Why an Hour of Waiting Is Worth Billions
Lerner’s core argument is disarmingly simple. “Without a time-delay lock, a single validation bug and a total loss become the exact same event, because funds move the moment software says ‘yes,'” he told crypto.news. Under his proposal, a software approval would start a waiting period instead of completing the withdrawal. Automated monitoring tools could compare the requested peg-out against the BTC actually backing the tokens, and flag any imbalance before settlement.
“If Liquid had possessed a time-delay lock — where funds cannot move for a specified period regardless of what the software or operators say — the bug would have resulted in a manageable incident rather than an immediate, full-scale catastrophe,” Lerner said. The delay would have given operators a multi-hour response window: functionaries could have paused the peg before the hardware wallets signed the transaction or released BTC from the federation wallet.
How Rootstock Already Does It
This is not a theoretical design. Rootstock, a Bitcoin sidechain, enforces a waiting period through specialized hardware security modules called PowHSMs. Before signing any peg-out, the devices independently verify that 4,000 Rootstock blocks have passed — roughly 36 hours of accumulated proof-of-work. The private keys never leave the hardware, and functionaries cannot instruct the devices to bypass the delay, even under pressure.
- 36-hour delay — PowHSMs require 4,000 Rootstock blocks of cumulative proof-of-work before signing a withdrawal.
- Hardware-enforced — private keys stay inside the devices; operators cannot force an early peg-out.
- Halt, not steal — even a colluding majority of functionaries can pause the peg but cannot redirect funds to themselves, Lerner said.
- Kill switch — when monitoring flags suspicious activity, functionaries can switch off their HSMs so a pending peg-out never gets a signature.
Lerner is candid about the trade-off: compromised functionaries could interrupt peg operations, creating what engineers call a liveness problem — your funds are safe but temporarily stuck. His answer to that risk is distribution. No single company or administrator should control the pause button. Revocation authority should be shared among independent, multi-party functionaries using hardware-enforced rules, so a pause can only be temporary and collective, never a tool for confiscation or censorship.
Why This Matters for Everyday Bitcoin Holders
Most people will never touch a bridge directly — but wrapped BTC and sidechain tokens sit inside the exchanges and wallets they use, and bridge failures are how ordinary holders get hurt. The roughly 320 million US dollars temporarily at stake in the Liquid incident dwarfs most exchange hacks of recent years, and the only reason it was not a permanent loss was that the actors chose to return the funds. That is luck, not security. A time-delay lock converts that luck into engineering.
There is also a simpler analogy for the fix, one Lerner himself points to: physical bank vaults. High-value vaults use time locks precisely so that even someone with the keys cannot open them instantly — the delay is the security. Lerner suggested bridges could scale delays by transaction size, with shorter waits for small transfers and longer ones for unusually large requests that deserve closer inspection.
The Long Game: Vaults Built Into Bitcoin Itself
Rootstock’s protection currently depends on its own federation rather than Bitcoin’s rules. The next step, Lerner said, is moving comparable safeguards into the base protocol through native Bitcoin vaults and revocation keys. One candidate building block is BIP-443, a draft proposal for an opcode called OP_CHECKCONTRACTVERIFY that would let a Bitcoin output carry data restricting how its funds can move in future transactions — effectively putting vault-style withdrawal controls into consensus rules rather than trusting any company’s hardware.
The Verdict: The Liquid incident could become the moment bridge security grew up. A 36-hour wait is a small price for the guarantee that a bug — or a thief — cannot empty a federation wallet in 23 minutes. Until mandatory delays become standard, treat every bridge holding your BTC on trust alone as a risk you are underwriting for free.
The cryptocurrency market remains highly volatile. This article is for informational purposes only and does not constitute financial advice.
3,996 BTC paid out in 23 minutes because unbacked L-BTC looked identical to the real thing. a 36 hour delay is such an obvious fix
agreed, and 598 BTC is still unaccounted for even after the white hats returned 3,400. the delay would have covered exactly that window
lerner saying instant settlement is the bug is gonna ruffle bridge teams, but 4,000 missing coins argues his case for him
3,996 BTC paid out in 23 minutes because fake L-BTC looked identical to the real thing. A 36-hour delay would have caught that. Lerner is right that instant settlement is the bug amplifier here.
The white hats returning 3,400 BTC is the only reason this is a discussion instead of a funeral. 598 BTC still outstanding.
Monitoring tools comparing peg-out requests against normal patterns during that window is the real payoff. A human can still pull the brake.
23 minutes from unbacked tokens to 3996 BTC gone. lerner is right, the instant peg-out is what turned a validation bug into a catastrophe
A 36 hour lock wouldnt have stopped the mint of unbacked L-BTC, just the payout. Still the right call, but lets be precise about what it fixes.
598 BTC still outstanding and people keep calling them white hats. returning 3400 doesnt erase the rest lol
Rootstock already runs the 36-hour lock, so the idea has production mileage behind it. Bridges marketing instant peg-outs are marketing risk.
We had this same debate after the big bridge hacks of 2022. Delays are not sexy but they work. Rootstock has run the waiting period model for years without incident.