{"investigation":{"slug":"liquid-network-exploit-september-2026","entity_name":"Liquid Network Exploit (September 2026)","trust_score":18,"severity_base":null,"score_modifier":0,"confidence":0.75,"status":"draft","content_type":"investigation","summary":"On September 6, 2026, attackers exploited a cache-verification bug in Blockstream's open-source Elements software to mint roughly 4,000 unbacked L-BTC on the Liquid Network and peg them out for real Bitcoin via federation member SideSwap, draining approximately 95% of the sidechain's BTC reserves (~$320 million). The attackers, claiming to be white hats, returned about 3,400 BTC (~85%) after a patch was deployed but retained roughly 598.5 BTC (~$47 million) as a self-declared bounty, which Blockstream has refused to authorize, calling it theft. The incident halted Liquid Network operations for several days and renewed scrutiny of the security assumptions underlying federated Bitcoin sidechains used by exchanges.","sections":[{"content":"According to Liquid Network's own incident report, a vulnerability in the open-source Elements software — related to how Liquid nodes cache range proof verifications — was exploited on September 6, 2026 at 15:53:10 UTC, at Liquid block 4,050,336. The caching flaw allowed an invalid confidential transaction output to be treated as already-verified, enabling the creation of approximately 4,000 L-BTC that were not backed by any corresponding Bitcoin held in the federation's reserve wallet. Multiple outlets reported that the attacker(s) then used SideSwap, a Liquid Federation member holding a peg-out authorization key (PAK), to convert the unbacked L-BTC into real BTC through Liquid's standard peg-out mechanism; SideSwap's systems reportedly could not distinguish the fraudulently minted tokens from legitimate ones. The federation approved and processed the peg-out, releasing roughly 3,996 BTC to an address controlled by the attackers within roughly 20-35 minutes of the initial exploit.","heading":"The Exploit: Technical Root Cause","sources":[{"url":"https://x.com/Liquid_BTC/status/2097404704028545175","name":"Liquid Network official incident report (X/Twitter)","type":"official","credibility":1},{"url":"https://www.trmlabs.com/resources/blog/2026s-biggest-hack-to-date-attackers-drained-usd-319-million-in-bitcoin-from-liquid-network-then-returned-85-of-funds","name":"TRM Labs — 2026's Biggest Hack To Date: Attackers Drained USD 319 Million in Bitcoin From Liquid Network, Then Returned 85% of Funds","type":"research","credibility":2},{"url":"https://www.coindesk.com/markets/2026/09/07/bitcoin-network-used-by-exchanges-hit-by-usd320-million-exploit-hackers-claim-they-re-the-good-guys","name":"CoinDesk — $320 million bitcoin exploit hits Liquid Network. Hacker makes conditional offer","type":"news_article","credibility":2},{"url":"https://crypto.news/liquid-network-320-million-drain-cache-bug-unbacked-bitcoin/","name":"crypto.news — Liquid Network drained of $320M in cache bug exploit","type":"news_article","credibility":2}],"severity":"critical"},{"content":"Liquid Network's federation wallet reportedly held approximately 4,200 BTC backing the circulating supply of L-BTC prior to the exploit. The attack drained the wallet to roughly 197 BTC, a loss of close to 95% of all Bitcoin ever pegged into the sidechain, valued at approximately $319-320 million at the time (Bitcoin priced around $79,750). This made it, per TRM Labs, the largest cryptocurrency-related hack reported in 2026 to that point. Because L-BTC in circulation exceeded the remaining BTC backing it, the token was reported to be trading at an estimated 86% backing ratio in the immediate aftermath, raising the possibility of a de-peg had the funds not been substantially returned.","heading":"Scale of Loss and Reserve Depletion","sources":[{"url":"https://www.trmlabs.com/resources/blog/2026s-biggest-hack-to-date-attackers-drained-usd-319-million-in-bitcoin-from-liquid-network-then-returned-85-of-funds","name":"TRM Labs incident analysis","type":"research","credibility":2},{"url":"https://www.cryptotimes.io/2026/09/07/liquid-network-pauses-after-4000-btc-leave-federation-wallet/","name":"CryptoTimes — Liquid Network Lost 4,000 BTC From Its Federation Wallet, Leaving Just 197 BTC Behind","type":"news_article","credibility":2}],"severity":"critical"},{"content":"Hours after the exploit, the attacker(s) embedded the on-chain OP_RETURN message 'we are whitehats. contact us on chain' and reportedly established encrypted on-chain communication with the Blockstream team. The attackers stated they would return the funds once every Liquid node was patched, writing in one message: 'Please fix the bug first. The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix.' After Elements v23.3.4 was deployed with a fix, the attackers returned approximately 3,400 BTC (~$272 million, about 85% of the stolen total) on September 7, 2026. They retained roughly 598.5 BTC (~$47 million), demanding it be treated as a 10% 'bug bounty' and reportedly asserting in an on-chain message that Blockstream had spent little protecting billions in assets, with an alleged threat framed around a further '15% loss' if the demand was not accepted. This self-declared white-hat framing is an unverified claim by the attackers themselves and should not be treated as an established fact; law enforcement has not confirmed the actors' identity or intent.","heading":"Attackers' Self-Declared 'White Hat' Claim and Ransom Demand","sources":[{"url":"https://247wallst.com/investing/cryptocurrency/2026/09/08/attackers-drained-4000-bitcoin-from-blockstreams-liquid-network-they-say-they-are-white-hats-and-want-to-give-it-back/","name":"247 Wall St. — Attackers Drained 4,000 Bitcoin From Blockstream's Liquid Network. They Say They Are White Hats and Want to Give It Back.","type":"news_article","credibility":2},{"url":"https://www.theblock.co/news/ecosystems/2026-09-11-return-the-bitcoin-blockstream-refuses-ransom-demand-for-remaining-600-btc-from-liquid-exploit-414247","name":"The Block — 'Return the bitcoin': Blockstream refuses ransom demand for remaining 600 BTC from Liquid exploit","type":"news_article","credibility":2},{"url":"https://www.trmlabs.com/resources/blog/2026s-biggest-hack-to-date-attackers-drained-usd-319-million-in-bitcoin-from-liquid-network-then-returned-85-of-funds","name":"TRM Labs incident analysis","type":"research","credibility":2}],"severity":"high"},{"content":"Blockstream publicly refused the attackers' demand to keep the remaining approximately 598.5 BTC (~$47 million) as a bounty. According to The Block, Blockstream stated: 'Taking assets without authorization and withholding their return is a crime' and 'We will not pay for the return of stolen property.' The company said it would pursue recovery through law enforcement cooperation, exchange partnerships, and blockchain forensic specialists. As of the most recent reporting, no jurisdiction had publicly opened a confirmed criminal case, no attacker identity had been established, and the withheld ~$47 million had not been recovered.","heading":"Blockstream's Refusal to Pay and Ongoing Recovery Efforts","sources":[{"url":"https://www.theblock.co/news/ecosystems/2026-09-11-return-the-bitcoin-blockstream-refuses-ransom-demand-for-remaining-600-btc-from-liquid-exploit-414247","name":"The Block — Blockstream refuses ransom demand for remaining 600 BTC from Liquid exploit","type":"news_article","credibility":2},{"url":"https://blockonomi.com/blockstream-takes-hard-stance-against-liquid-network-hackers-demanding-ransom-for-598-btc","name":"Blockonomi — Blockstream Takes Hard Stance Against Liquid Network Hackers Demanding Ransom for 598 BTC","type":"news_article","credibility":2}],"severity":"high"},{"content":"Blockstream disabled the network's peg-out capability and paused Liquid Network operations within hours of the exploit. Elements version 23.3.4, containing a fix for the range-proof caching vulnerability, was reportedly deployed on September 9, 2026, and the network resumed block production and transactions around September 10, 2026, though peg-outs reportedly remained disabled as a precaution while recovery and forensic efforts continued. Exchanges and infrastructure providers listed as Liquid Federation participants or users at the time included Bitfinex, BTSE, and BitMEX, among others reported in coverage of the federation's roughly 80-87 member organizations, of which a smaller subset of rotating 'functionaries' (reported as 15) actually control block production and peg authorization.","heading":"Network Response, Patch, and Resumption","sources":[{"url":"https://www.theblock.co/news/ecosystems/2026-09-11-return-the-bitcoin-blockstream-refuses-ransom-demand-for-remaining-600-btc-from-liquid-exploit-414247","name":"The Block — Blockstream refuses ransom demand for remaining 600 BTC from Liquid exploit","type":"news_article","credibility":2},{"url":"https://crypto.news/liquid-network-320-million-drain-cache-bug-unbacked-bitcoin/","name":"crypto.news — Liquid Network drained of $320M in cache bug exploit (exchange/federation membership context)","type":"news_article","credibility":2},{"url":"https://www.spark.money/research/liquid-network-federated-sidechain","name":"Spark Research — Liquid Network Deep Dive: How Blockstream's Federated Sidechain Works","type":"research","credibility":2}],"severity":"medium"},{"content":"The exploit renewed pre-existing criticism of Liquid Network's federated trust model. Commentators have argued that a code-level bug enabling a single party to fraudulently trigger a peg-out demonstrates that Liquid's security is dependent on the correctness of a relatively small codebase and a limited set of trusted functionaries, rather than on Bitcoin-level proof-of-work security — a critique some described as 'decentralization theater.' Prior reporting (Protos) had also characterized Liquid as underused relative to its cost and complexity even before the 2026 incident. These are characterizations and opinions found in industry commentary rather than findings of a regulator or court, and are presented here as such.","heading":"Structural and Governance Criticism","sources":[{"url":"https://protos.com/blockstreams-pricey-liquid-sidechain-is-flawed-and-underused/","name":"Protos — Blockstream's pricey Liquid sidechain is flawed and underused","type":"news_article","credibility":2},{"url":"https://medium.com/chainrift-research/blockstreams-new-liquid-network-asks-us-to-rethink-trust-4d7a7b26860b","name":"ChainRift Research (Medium) — Blockstream's new Liquid Network asks us to rethink trust","type":"research","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2018","event":"Liquid Network launches, a federated Bitcoin sidechain operated by Blockstream and a consortium of exchanges and infrastructure providers, intended to enable faster settlement and confidential asset transfers pegged to Bitcoin.","source":"DataDrivenInvestor / general reporting","source_url":"https://www.datadriveninvestor.com/2018/10/17/how-is-bitcoins-liquid-sidechain-different-from-the-lightning-network/"},{"date":"2026-09-06","event":"Attackers exploit a range-proof verification caching bug in Elements to mint approximately 4,000 unbacked L-BTC and peg it out for real BTC via federation member SideSwap, draining the federation reserve wallet from roughly 4,200 BTC to about 197 BTC (~95% loss, ~$320 million).","source":"Liquid Network official incident report (X)","source_url":"https://x.com/Liquid_BTC/status/2097404704028545175","date_evidence":"On September 6, 2026 at 15:53:10 UTC (Liquid block 4,050,336), a vulnerability in the open-source Elements software related to how Liquid nodes cache range proof verifications"},{"date":"2026-09","event":"Attackers post an on-chain OP_RETURN message reading 'we are whitehats. contact us on chain,' and Blockstream disables peg-outs and pauses the network.","source":"TRM Labs","source_url":"https://www.trmlabs.com/resources/blog/2026s-biggest-hack-to-date-attackers-drained-usd-319-million-in-bitcoin-from-liquid-network-then-returned-85-of-funds","date_original":"2026-09-06"},{"date":"2026-09","event":"Attackers return approximately 3,400 BTC (~$272 million, ~85% of stolen funds) after Blockstream confirms a patch; roughly 598.5 BTC (~$47 million) is retained by the attackers as a self-declared bounty.","source":"TRM Labs / CoinDesk","source_url":"https://www.coindesk.com/markets/2026/09/07/bitcoin-network-used-by-exchanges-hit-by-usd320-million-exploit-hackers-claim-they-re-the-good-guys","date_original":"2026-09-07"},{"date":"2026-09-08","event":"Liquid Network publishes a formal incident report detailing the timeline, root cause, and status of the exploit.","source":"Liquid Network official incident report (X)","source_url":"https://x.com/Liquid_BTC/status/2097404704028545175","date_evidence":"Status as of September 8, 2026, 19:10 UTC"},{"date":"2026-09","event":"Elements v23.3.4, containing a fix for the range-proof caching vulnerability, is deployed across the network.","source":"The Block","source_url":"https://www.theblock.co/news/ecosystems/2026-09-11-return-the-bitcoin-blockstream-refuses-ransom-demand-for-remaining-600-btc-from-liquid-exploit-414247","date_original":"2026-09-09"},{"date":"2026-09","event":"Liquid Network resumes block production and transactions; peg-outs remain disabled as a precaution.","source":"The Block","source_url":"https://www.theblock.co/news/ecosystems/2026-09-11-return-the-bitcoin-blockstream-refuses-ransom-demand-for-remaining-600-btc-from-liquid-exploit-414247","date_original":"2026-09-10"},{"date":"2026-09-11","event":"Blockstream publicly refuses the attackers' ransom-style demand for the remaining ~598 BTC, stating it will not pay for the return of stolen property and will pursue law enforcement and forensic recovery.","source":"The Block","source_url":"https://www.theblock.co/news/ecosystems/2026-09-11-return-the-bitcoin-blockstream-refuses-ransom-demand-for-remaining-600-btc-from-liquid-exploit-414247","date_evidence":"2026-09-11-return-the-bitcoin-blockstream-refuses-ransom-demand-for-remaining-600-btc-from-liquid-exploit"}],"sources_used":[{"url":"https://x.com/Liquid_BTC/status/2097404704028545175","name":"Liquid Network official incident report (X/Twitter)","type":"official","archive_url":null,"credibility":1,"archive_timestamp":null},{"url":"https://www.trmlabs.com/resources/blog/2026s-biggest-hack-to-date-attackers-drained-usd-319-million-in-bitcoin-from-liquid-network-then-returned-85-of-funds","name":"TRM Labs — 2026's Biggest Hack To Date","type":"research","archive_url":"http://web.archive.org/web/20260913235354/https://www.trmlabs.com/resources/blog/2026s-biggest-hack-to-date-attackers-drained-usd-319-million-in-bitcoin-from-liquid-network-then-returned-85-of-funds","credibility":2,"archive_timestamp":"2026-09-13T23:53:54+00:00"},{"url":"https://www.coindesk.com/markets/2026/09/07/bitcoin-network-used-by-exchanges-hit-by-usd320-million-exploit-hackers-claim-they-re-the-good-guys","name":"CoinDesk — $320 million bitcoin exploit hits Liquid Network","type":"news_article","archive_url":null,"credibility":2,"archive_timestamp":null},{"url":"https://www.theblock.co/news/ecosystems/2026-09-11-return-the-bitcoin-blockstream-refuses-ransom-demand-for-remaining-600-btc-from-liquid-exploit-414247","name":"The Block — Blockstream refuses ransom demand for remaining 600 BTC from Liquid exploit","type":"news_article","archive_url":"http://web.archive.org/web/20260911121652/https://www.theblock.co/news/ecosystems/2026-09-11-return-the-bitcoin-blockstream-refuses-ransom-demand-for-remaining-600-btc-from-liquid-exploit-414247","credibility":2,"archive_timestamp":"2026-09-11T12:16:52+00:00"},{"url":"https://247wallst.com/investing/cryptocurrency/2026/09/08/attackers-drained-4000-bitcoin-from-blockstreams-liquid-network-they-say-they-are-white-hats-and-want-to-give-it-back/","name":"247 Wall St. — Attackers Drained 4,000 Bitcoin From Blockstream's Liquid Network","type":"news_article","archive_url":"http://web.archive.org/web/20260909093942/https://247wallst.com/investing/cryptocurrency/2026/09/08/attackers-drained-4000-bitcoin-from-blockstreams-liquid-network-they-say-they-are-white-hats-and-want-to-give-it-back/","credibility":2,"archive_timestamp":"2026-09-09T09:39:42+00:00"},{"url":"https://crypto.news/liquid-network-320-million-drain-cache-bug-unbacked-bitcoin/","name":"crypto.news — Liquid Network drained of $320M in cache bug exploit","type":"news_article","archive_url":"http://web.archive.org/web/20260911215018/https://crypto.news/liquid-network-320-million-drain-cache-bug-unbacked-bitcoin/","credibility":2,"archive_timestamp":"2026-09-11T21:50:18+00:00"},{"url":"https://www.cryptotimes.io/2026/09/07/liquid-network-pauses-after-4000-btc-leave-federation-wallet/","name":"CryptoTimes — Liquid Network Lost 4,000 BTC From Its Federation Wallet","type":"news_article","archive_url":"http://web.archive.org/web/20260907091230/https://www.cryptotimes.io/2026/09/07/liquid-network-pauses-after-4000-btc-leave-federation-wallet/","credibility":2,"archive_timestamp":"2026-09-07T09:12:30+00:00"},{"url":"https://blockonomi.com/blockstream-takes-hard-stance-against-liquid-network-hackers-demanding-ransom-for-598-btc","name":"Blockonomi — Blockstream Takes Hard Stance Against Liquid Network Hackers","type":"news_article","archive_url":"http://web.archive.org/web/20260911211519/https://blockonomi.com/blockstream-takes-hard-stance-against-liquid-network-hackers-demanding-ransom-for-598-btc","credibility":2,"archive_timestamp":"2026-09-11T21:15:19+00:00"},{"url":"https://protos.com/blockstreams-pricey-liquid-sidechain-is-flawed-and-underused/","name":"Protos — Blockstream's pricey Liquid sidechain is flawed and underused","type":"news_article","archive_url":"http://web.archive.org/web/20260421073644/https://protos.com/blockstreams-pricey-liquid-sidechain-is-flawed-and-underused/","credibility":2,"archive_timestamp":"2026-04-21T07:36:44+00:00"},{"url":"https://www.spark.money/research/liquid-network-federated-sidechain","name":"Spark Research — Liquid Network Deep Dive","type":"research","archive_url":"http://web.archive.org/web/20260713155050/https://www.spark.money/research/liquid-network-federated-sidechain","credibility":2,"archive_timestamp":"2026-07-13T15:50:50+00:00"},{"url":"https://medium.com/chainrift-research/blockstreams-new-liquid-network-asks-us-to-rethink-trust-4d7a7b26860b","name":"ChainRift Research (Medium) — Blockstream's new Liquid Network asks us to rethink trust","type":"research","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-code-investigator","created_at":"2026-09-13T23:10:09.623717+00:00","updated_at":"2026-09-14T01:17:48.159644+00:00"}}