Rootstock co-founder Sergio Lerner has called for Bitcoin bridges to adopt mandatory withdrawal delays following a significant incident on the Liquid Network. According to reports from crypto.news, actors created unbacked L-BTC and used SideSwap's peg-out service to withdraw nearly 4,000 BTC from the Liquid Federation wallet. Liquid described the actors as purported white-hat hackers, while SideSwap processed the request because the L-BTC appeared valid. The actors later returned 3,400 BTC after Blockstream confirmed that affected bridge nodes had been patched, leaving about 598 BTC outstanding as of September 10.
Lerner argued that immediate settlement can turn a single validation error into a total loss before bridge operators have time to respond. As reported by crypto.news, he stated that "without a time-delay lock, a single validation bug and a total loss become the exact same event, because funds move the moment software says 'yes.'" A mandatory delay between unbacked token creation and BTC release could have created an intervention window for operators. Under such a system, software approval would start a waiting period rather than complete the withdrawal, with automated monitoring tools comparing peg-out requests with BTC backing and flagging any imbalances before settlement.
Rootstock already implements a delay mechanism for BTC withdrawals through its two-way peg system, though Bitcoin's consensus rules do not enforce the waiting period. According to Lerner's explanation to crypto.news, the system relies on specialized hardware security modules called PowHSMs that independently verify 4,000 Rootstock blocks have passed, representing about 36 hours of cumulative proof-of-work. Private keys remain inside the devices, and functionaries cannot instruct the hardware to bypass the required period. Lerner emphasized that "even a colluding majority of pegnatories cannot steal the funds, because the private keys never leave the PowHSMs, and the HSMs independently verify that 4,000 Rootstock blocks have elapsed before they will sign."
Lerner proposed that revocation controls should be distributed among independent, multi-party functionaries using hardware-enforced rules rather than centralized administrative keys. As reported by crypto.news, he stated that "to prevent single points of failure or centralized censorship, revocation controls should be distributed among independent, multi-party functionaries using hardware-enforced rules rather than centralized administrative keys." Under his proposed model, functionaries could pause processing but could not redirect BTC to another address or confiscate it. He noted that a colluding majority can halt the peg but cannot force an unauthorized withdrawal, with operators able to switch off their HSMs to protect underlying BTC while examining problems.
Lerner suggested that native Bitcoin vaults and revocation keys could move comparable controls into the base protocol through proposals like BIP-443. According to his comments to crypto.news, BIP-443 describes an opcode called OP_CHECKCONTRACTVERIFY that would allow Bitcoin outputs to carry data and restrict fund movement through future transactions. He cited this proposal as an example of how native vaults could give users or designated parties time to cancel withdrawals after detecting stolen credentials or altered software. Moving the mechanism into Bitcoin consensus would reduce reliance on bridge-specific HSM policies, with miners and functionaries following spending conditions attached to Bitcoin outputs rather than applying discretionary pauses after funds had already moved.
