Galaxy’s Alex Thorn: Liquid’s Approved-Address Rule Failed to Stop 4,000 BTC Theft

The episode undercuts a core assumption about permissioned rails: that an allowlist at the withdrawal layer is sufficient protection. If a restriction designed to prevent exactly this outcome was in place yet the coins still reached an attacker, the failure likely sits in key management, authorization logic or an operational path around the control, not in the concept of allowlisting itself. For projects using similar approved-address models, the open question is whether the control was bypassed technically or socially — and whether other deployments share the same weakness.