At 14:28 UTC on Sunday, the Liquid Federation paid out 3,996 bitcoin to a customer’s address on the main chain. Nothing about the payment looked wrong. A peg-out request had come in through SideSwap, an approved trading venue on the network, the matching L-BTC had been burned on the sidechain the way the protocol requires, and the signers signed. A small 2.5 BTC transfer had gone out just before it. The two amounts ended up consolidated in a single address holding about 3,998.5 BTC.

More than two billion dollars has been stolen from cross-chain bridges since 2021. Ronin, Wormhole, Nomad, Harmony Horizon — the list of exploited bridge protocols reads like a chronicle of the same mistake repeated with varying degrees of sophistication. The mistake is not a bug. It is the fundamental architecture of the problem: moving assets between blockchains requires trusting something, and in distributed systems, trust is the attack surface.

The industry has not resolved this. It has repackaged it.