{"investigation":{"slug":"liquid-network-elements-cache-bug-exploit-september-2026","entity_name":"Liquid Network / Elements Cache-Bug Exploit (September 2026)","trust_score":17,"severity_base":null,"score_modifier":-1.4,"confidence":0.87,"status":"published","content_type":"investigation","summary":"On September 6, 2026, an attacker exploited a caching flaw in Elements, the open-source software underlying Blockstream's Liquid Network Bitcoin sidechain, to mint roughly 4,000 unbacked L-BTC and peg it out to native bitcoin worth approximately $319 million, draining about 95% of the federation's reserve wallet. The attacker, claiming to be a \"white hat,\" returned about 3,400 BTC after Blockstream patched the bug but kept roughly 598.5 BTC (about $47 million) as a self-declared bounty; Blockstream publicly refused to pay a ransom for the remainder. The incident, the largest crypto theft reported in 2026 to that point, renewed scrutiny of Liquid's federated trust model, cost, and adoption levels.","sections":[{"content":"According to third-party technical analysis, the vulnerability was a cache-key collision in Elements' rangeproof verification cache. Elements caches the results of successful (expensive) rangeproof verifications to avoid repeating the cryptographic check. An earlier fix (referenced as commit c26d719 in third-party analysis) attempted to bind the cache key to the full validation context — the rangeproof, value commitment, asset generator, and script — but did so by hashing the raw, variable-length fields together into a single SHA-256 stream without encoding field lengths or boundaries. Because the rangeproof and script fields are variable length, distinct field tuples could be rearranged to produce an identical byte stream and therefore an identical cache key. Analysts describe the attacker constructing a 'primer' transaction whose legitimate, valid tuple collided under this scheme with a crafted invalid tuple used in a subsequent attack transaction. Because the cache lookup occurred before commitment parsing and before the underlying secp256k1 rangeproof verification function ran, a cache hit on a 'primed' node returned a positive validity result immediately, skipping real cryptographic verification of the attacker's rangeproof. Since Confidential Transactions' commitment equation still balanced algebraically, the missing rangeproof check allowed an output that appeared to mint value from an artificially negative-value input, producing roughly 3,998.5 unbacked L-BTC. The attacker then pegged this out to native bitcoin via SideSwap, a Liquid Federation member that holds a peg-out authorization key. CertiK's analysis notes that the exact binaries running on individual federation functionary nodes were not published, so attribution of the specific flawed commit is an inference rather than a confirmed fact. Liquid's own September 8 incident update similarly described the issue as a caching flaw in rangeproof verification and said no federation signing keys were compromised.","heading":"The Exploit: Technical Root Cause","sources":[{"url":"https://www.certik.com/blog/liquid-network-incident-analysis","name":"CertiK — Liquid Network Incident Analysis","type":"research","credibility":2},{"url":"https://www.theblock.co/news/ecosystems/2026-09-11-return-the-bitcoin-blockstream-refuses-ransom-demand-for-remaining-600-btc-from-liquid-exploit-414247","name":"The Block — 'Return the bitcoin': Blockstream refuses ransom demand for remaining 600 BTC from Liquid exploit","type":"news_article","credibility":1},{"url":"https://www.trmlabs.com/resources/blog/2026s-biggest-hack-to-date-attackers-drained-usd-319-million-in-bitcoin-from-liquid-network-then-returned-85-of-funds","name":"TRM Labs — 2026's biggest hack to date: attackers drained $319 million in bitcoin from Liquid Network, then returned 85% of funds","type":"research","credibility":2}],"severity":"critical"},{"content":"TRM Labs reports that on September 6, 2026, approximately 4,000 BTC (valued at roughly $319 million) was withdrawn from Liquid's federation reserve wallet, representing about 95% of its approximately 4,200 BTC balance at the time. CoinTelegraph similarly reported the federation wallet lost roughly 4,000 of its roughly 4,200 BTC. TRM Labs characterized this as the largest crypto theft recorded in 2026 up to that point, ahead of incidents at KelpDAO (~$292 million) and Drift (~$285 million) earlier in the year, and noted total 2026 crypto theft losses of approximately $1.73 billion across 333 incidents. After roughly 3,400 BTC was returned on September 7, CryptoTimes and other outlets reported the network paused operations, and TRM Labs noted that, based on an identified reserve address holding about 3,597 BTC against an estimated 4,200 L-BTC outstanding, the implied backing ratio stood at roughly 86% — a figure TRM cautioned was not a full reserve reconciliation, since Blockstream had not at that time announced how any shortfall would be addressed.","heading":"Scale of Loss and Reserve Depletion","sources":[{"url":"https://www.trmlabs.com/resources/blog/2026s-biggest-hack-to-date-attackers-drained-usd-319-million-in-bitcoin-from-liquid-network-then-returned-85-of-funds","name":"TRM Labs — 2026's biggest hack to date","type":"research","credibility":2},{"url":"https://www.cryptotimes.io/2026/09/07/liquid-network-pauses-after-4000-btc-leave-federation-wallet/","name":"CryptoTimes — Liquid Network Pauses After 4000 BTC Leave Federation Wallet","type":"news_article","credibility":2},{"url":"https://cointelegraph.com/news/liquid-network-resumes-block-production-after-320m-exploit","name":"CoinTelegraph — Liquid Network resumes block production after $320M exploit","type":"news_article","credibility":1}],"severity":"critical"},{"content":"The attacker embedded the message \"we are whitehats. contact us on chain\" in an OP_RETURN field and subsequently communicated with Blockstream via encrypted on-chain messaging, according to CertiK's analysis and reporting from The Block. The attacker reportedly pledged to return the funds once all nodes had patched the underlying bug, and did return roughly 3,400 BTC on September 7 after Blockstream confirmed affected bridge nodes were patched. However, in a message dated Wednesday, September 9, 2026 and sent via OP_RETURN, the attacker demanded a 10% 'bug bounty' for the remaining funds, arguing that Blockstream had spent comparatively little — characterized as '$1.5 million, maybe even 0' — to secure roughly $5 billion in assets. The legitimacy of the 'white hat' framing has been publicly disputed; Ledger CTO Charles Guillemet was quoted stating that if the arrangement amounted to a negotiated reward under an encrypted on-chain contract, it looked 'more like extortion than white-hat hacking.' TRM Labs noted it had labeled the attacker's wallet addresses within a day of the incident and continued tracking the roughly 598.5 BTC retained by the attacker.","heading":"Attackers' Self-Declared 'White Hat' Claim and Ransom Demand","sources":[{"url":"https://www.theblock.co/news/ecosystems/2026-09-11-return-the-bitcoin-blockstream-refuses-ransom-demand-for-remaining-600-btc-from-liquid-exploit-414247","name":"The Block — Blockstream refuses ransom demand","type":"news_article","credibility":1},{"url":"https://www.certik.com/blog/liquid-network-incident-analysis","name":"CertiK — Liquid Network Incident Analysis","type":"research","credibility":2},{"url":"https://decrypt.co/377723/liquid-hack-47m-blockstream-bargains-white-hat","name":"Decrypt — $47M Still Missing After Liquid Hack as Blockstream Bargains With 'White Hats'","type":"news_article","credibility":2}],"severity":"high"},{"content":"On Friday, September 11, 2026, Blockstream publicly told the exploiter to 'return the bitcoin' and stated it would not pay a bounty for the remaining approximately 598.5 BTC, according to The Block. Blockstream characterized the taking and withholding of the assets as theft rather than responsible disclosure, and said it would not set a precedent of open-source developers paying ransoms disproportionate to their economic participation. The company stated that if the funds were not returned, it would work with law enforcement, exchanges, and forensic specialists to trace the assets and identify those responsible. As of the most recent reporting reviewed, the roughly $47 million in retained funds had not been recovered, and TRM Labs continued tracking the associated wallet addresses.","heading":"Blockstream's Refusal to Pay and Ongoing Recovery Efforts","sources":[{"url":"https://www.theblock.co/news/ecosystems/2026-09-11-return-the-bitcoin-blockstream-refuses-ransom-demand-for-remaining-600-btc-from-liquid-exploit-414247","name":"The Block — Blockstream refuses ransom demand for remaining 600 BTC","type":"news_article","credibility":1},{"url":"https://www.trmlabs.com/resources/blog/2026s-biggest-hack-to-date-attackers-drained-usd-319-million-in-bitcoin-from-liquid-network-then-returned-85-of-funds","name":"TRM Labs — 2026's biggest hack to date","type":"research","credibility":2}],"severity":"high"},{"content":"Per CoinTelegraph and The Block, Liquid published an incident update on September 8, 2026 describing the caching flaw in Elements' rangeproof verification and stating that no federation operator keys had been compromised. Elements version 23.3.4, an emergency release hardening the cache-key scheme used for range proofs, was deployed on September 9, 2026. Liquid resumed block production on September 10, 2026, initially 'without transactions' as a precaution while monitoring for full network stabilization; functionary and bridge nodes had been updated, and functionary nodes resumed signing and validating blocks. Peg operations, including PAK-authorized peg-outs, remained suspended at that time while the network worked to restore its BTC/L-BTC reserve ratio. Later reporting referenced in secondary sources indicated the network entered what was described as the 'final stages of recovery' more than a month after the incident, though independent confirmation of full peg-out resumption was not found in the sources reviewed for this page.","heading":"Network Response, Patch, and Resumption","sources":[{"url":"https://cointelegraph.com/news/liquid-network-resumes-block-production-after-320m-exploit","name":"CoinTelegraph — Liquid Network resumes block production after $320M exploit","type":"news_article","credibility":1},{"url":"https://www.theblock.co/news/ecosystems/2026-09-11-return-the-bitcoin-blockstream-refuses-ransom-demand-for-remaining-600-btc-from-liquid-exploit-414247","name":"The Block — Blockstream refuses ransom demand","type":"news_article","credibility":1}],"severity":"medium"},{"content":"The exploit renewed pre-existing criticism of Liquid's federated architecture, cost, and adoption. Protos reported that Liquid is governed by a federation of roughly 15 functionaries who must jointly authorize movement of pegged bitcoin via an 11-of-15 multisig, meaning L-BTC's value and redeemability depend on continued trust in those functionaries rather than on cryptographic guarantees alone; critics quoted in the piece, including developer BenTheCarman, described Liquid as 'a fork of bitcoin with a few fancy things added' bundled with federated custody and Blockstream branding. The same article reported low network usage — commentator Udi Wertheimer was quoted saying 'no one's using it,' with the piece noting that on a typical day there were more tweets about Liquid than transactions on its network — and noted Blockstream had raised approximately $210 million at a $4 billion valuation in 2021, partly to develop and monetize Liquid, spending the Protos piece characterized as likely wasted given low adoption and centralization concerns. Separately, research comparing Liquid to competing Bitcoin layer-2 designs (published by Spark, a corporate competitor, and therefore a self-interested source) similarly described the 11-of-15 multisig federation structure and noted that users moving funds back to the Bitcoin mainchain require cooperation from at least 11 federation members, with no unilateral exit path for an individual user. These structural characteristics — a trusted federation rather than a trust-minimized bridge — are the same architecture implicated in the September 2026 exploit, since the attacker's unbacked L-BTC was redeemed through a standard peg-out process that the federation's software incorrectly validated as legitimate.","heading":"Structural and Governance Criticism","sources":[{"url":"https://protos.com/blockstreams-pricey-liquid-sidechain-is-flawed-and-underused/","name":"Protos — Blockstream's pricey Liquid sidechain is flawed and underused","type":"news_article","credibility":2},{"url":"https://www.spark.money/research/liquid-network-federated-sidechain","name":"Spark Money Research — Liquid Network Deep Dive: How Blockstream's Federated Sidechain Works","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2026-09-06","event":"Attacker exploits a rangeproof verification caching flaw in Elements to mint roughly 4,000 unbacked L-BTC and peg it out to native bitcoin via SideSwap, draining about 95% of Liquid's federation reserve wallet (~$319 million).","source":"TRM Labs","source_url":"https://www.trmlabs.com/resources/blog/2026s-biggest-hack-to-date-attackers-drained-usd-319-million-in-bitcoin-from-liquid-network-then-returned-85-of-funds","date_evidence":"The drain occurred on September 6, 2026. The minting happened at 13:53 UTC in block 4,050,336, and the federation paid out at 14:28 UTC."},{"date":"2026-09","event":"Attacker returns approximately 3,400 BTC (about $270 million) to the federation wallet after Blockstream confirms affected bridge nodes have been patched; roughly 598.5 BTC remains unreturned.","source":"The Block","source_url":"https://www.theblock.co/news/ecosystems/2026-09-11-return-the-bitcoin-blockstream-refuses-ransom-demand-for-remaining-600-btc-from-liquid-exploit-414247","date_evidence":"Sept. 7: The exploiter returned roughly 3,400 BTC, but about 598.5 BTC was not returned.","date_original":"2026-09-07"},{"date":"2026-09","event":"Liquid publishes an incident update describing the rangeproof caching flaw in Elements and states no federation operator keys were compromised.","source":"The Block","source_url":"https://www.theblock.co/news/ecosystems/2026-09-11-return-the-bitcoin-blockstream-refuses-ransom-demand-for-remaining-600-btc-from-liquid-exploit-414247","date_evidence":"Sept. 8: Liquid issued an incident report. A flaw in Elements' caching of range proof verifications allowed about 4,000 unbacked LBTC to be created.","date_original":"2026-09-08"},{"date":"2026-09","event":"Emergency patch Elements v23.3.4 is deployed, hardening the cache-key scheme used in rangeproof verification. Separately, the attacker demands a 10% 'bug bounty' for the remaining funds via an on-chain message.","source":"The Block","source_url":"https://www.theblock.co/news/ecosystems/2026-09-11-return-the-bitcoin-blockstream-refuses-ransom-demand-for-remaining-600-btc-from-liquid-exploit-414247","date_evidence":"Sept. 9: Elements v23.3.4 was deployed.","date_original":"2026-09-09"},{"date":"2026-09","event":"Liquid Network resumes block production, initially without processing transactions, as functionary and bridge nodes complete required updates; peg-outs remain suspended.","source":"CoinTelegraph","source_url":"https://cointelegraph.com/news/liquid-network-resumes-block-production-after-320m-exploit","date_evidence":"Sept. 10: Liquid resumed block production and transactions.","date_original":"2026-09-10"},{"date":"2026-09-11","event":"Blockstream publicly refuses to pay the attacker's ransom demand for the remaining approximately 598.5 BTC, calling it theft and stating it will pursue law enforcement and forensic tracing if funds are not returned.","source":"The Block","source_url":"https://www.theblock.co/news/ecosystems/2026-09-11-return-the-bitcoin-blockstream-refuses-ransom-demand-for-remaining-600-btc-from-liquid-exploit-414247","date_evidence":"On Friday, September 11, 2026, Blockstream told the exploiter to \"Return the bitcoin\" and said it would not pay the bounty for the remaining 598.5 BTC."}],"sources_used":[{"url":"https://www.trmlabs.com/resources/blog/2026s-biggest-hack-to-date-attackers-drained-usd-319-million-in-bitcoin-from-liquid-network-then-returned-85-of-funds","name":"TRM Labs — 2026's biggest hack to date: attackers drained $319 million in bitcoin from Liquid Network, then returned 85% of funds","type":"research","credibility":2},{"url":"https://www.theblock.co/news/ecosystems/2026-09-11-return-the-bitcoin-blockstream-refuses-ransom-demand-for-remaining-600-btc-from-liquid-exploit-414247","name":"The Block — 'Return the bitcoin': Blockstream refuses ransom demand for remaining 600 BTC from Liquid exploit","type":"news_article","credibility":1},{"url":"https://www.cryptotimes.io/2026/09/07/liquid-network-pauses-after-4000-btc-leave-federation-wallet/","name":"CryptoTimes — Liquid Network Pauses After 4000 BTC Leave Federation Wallet","type":"news_article","credibility":2},{"url":"https://protos.com/blockstreams-pricey-liquid-sidechain-is-flawed-and-underused/","name":"Protos — Blockstream's pricey Liquid sidechain is flawed and underused","type":"news_article","credibility":2},{"url":"https://www.spark.money/research/liquid-network-federated-sidechain","name":"Spark Money Research — Liquid Network Deep Dive: How Blockstream's Federated Sidechain Works","type":"other","credibility":3},{"url":"https://www.certik.com/blog/liquid-network-incident-analysis","name":"CertiK — Liquid Network Incident Analysis","type":"research","credibility":2},{"url":"https://cointelegraph.com/news/liquid-network-resumes-block-production-after-320m-exploit","name":"CoinTelegraph — Liquid Network resumes block production after $320M exploit","type":"news_article","credibility":1},{"url":"https://decrypt.co/377723/liquid-hack-47m-blockstream-bargains-white-hat","name":"Decrypt — $47M Still Missing After Liquid Hack as Blockstream Bargains With 'White Hats'","type":"news_article","credibility":2}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-code-investigator","created_at":"2026-09-11T17:41:48.850732+00:00","updated_at":"2026-10-27T04:28:20.067+00:00"},"source_quality":{"total":8,"tier1":0,"tier2":5,"tier3":0,"unrated":3},"follower_count":null,"content_updated_at":"2026-10-27T04:28:20.529Z","last_fact_checked_at":null,"fact_check_next_allowed_at":null,"update_next_allowed_at":"2026-11-03T04:28:24.656Z"}