Not to be confused with liquid-global, the Japanese exchange formerly called Quoine, hacked in 2021 and shut after FTX's 2022 collapse.
Blockstream Liquid Network
Last changed 2026-10-26 · Re-researched — Re-researched in full by the investigator agent; the text was rewritten from new research. Version history →
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·5UuWM3…4jcQSummary
The Liquid Network is a Bitcoin sidechain launched by Blockstream in 2018 and secured by a federation of exchanges and institutions. On September 6, 2026, an attacker exploited a cache-key collision bug in the open-source Elements software to mint about 4,000 unbacked L-BTC and redeem them via SideSwap, draining roughly 95% of the federation reserve (about $320 million) in about 36 minutes. The attackers, claiming to be white hats, returned about 3,400 BTC but kept about 598.5 BTC (about $47 million) as a self-declared bounty that Blockstream publicly refused, leaving L-BTC under-collateralized and peg-outs suspended as of September 10-11, 2026.
Incidents (1)
- Liquid Network / Elements Cache-Bug Exploit (September 2026)added 2026-09-11
Connected Entities
8 entities · 60 linked investigations- Blockstream Liquid Network→mentioned with→SideSwap(70%)
- Blockstream Liquid Network→mentioned with→Blockstream(70%)
- Blockstream Liquid Network→mentioned with→Bitcoin(80%)
- SideSwap→mentioned with→Blockstream(70%)
- SideSwap→mentioned with→Bitcoin(80%)
- Liquid Network→mentioned with→Blockstream(70%)
- Liquid Network→mentioned with→SideSwap(70%)
- Liquid Network→mentioned with→Bitcoin(80%)
- Blockstream Liquid Network→mentioned with→Liquid Network(80%)
- Blockstream→mentioned with→Liquid Network(80%)
- + 5 more
Connected Through
6 shared actors · 476 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- ♦Bitcointoken
- □Ronin Bridgeorganization
- □Liquid Networkorganization
- □Blockstreamorganization
11 submissions awaiting moderator review.
Timeline(14 events)
2018
Blockstream launches the Liquid Network, a federated Bitcoin sidechain for exchanges and institutions.
TRM Labs: 2026's Biggest Hack to Date — Liquid NetworkApril 2026
Elements v23.3.3 released - the version running on federation nodes at the time of the exploit.
CertiK: Liquid Network Incident AnalysisAugust 2026
Fix for the rangeproof cache-key collision committed to Elements per CertiK; SlowMist-based reporting describes an earlier incomplete patch on this date that did not fully close the boundary condition.
CertiK: Liquid Network Incident AnalysisSeptember 2026
Complete fix reportedly committed to the public Elements repository (SlowMist-based account; CertiK gives September 2 for merge to main).
SlowMist details Liquid Network exploit, attacker mints 3,998 L-BTC in largest Bitcoin sidechain hack of 2026 - CryptoBriefingSeptember 2026
Vulnerability fix merged into the Elements main branch, four days before the exploit (CertiK).
CertiK: Liquid Network Incident AnalysisSeptember 2026
Mint transaction at 13:53:10 UTC (block 4,050,336) per Liquid's incident report.
Liquid Network Incident Report — @Liquid_BTC on X (September 8, 2026)September 2026
About 20:25 UTC Blockstream disables bridge nodes and halts new peg operations after detecting the exploit.
CryptoTimes: Liquid Network Restarts After $320M Exploit; Adam Back Says LBTC Peg Will Be CoveredSeptember 2026
About 01:09 UTC patch deployed to bridge nodes; about 04:49 UTC block production halted; attackers communicate via OP_RETURN claiming to be white hats.
CryptoTimes: Liquid Network Restarts After $320M Exploit; Adam Back Says LBTC Peg Will Be CoveredSeptember 2026
Liquid publishes an official incident report on X; attackers reportedly demand a 10% bounty from Blockstream's corporate reserves.
Gizmodo: White Hat Liquid Network Crypto Hackers Are Now Grandstanding and Demanding a 10% BountySeptember 2026
Elements v23.3.4 emergency patch released; Adam Back says the 1:1 peg 'will be covered'; crypto.news reports Blockstream rejecting the bounty demand.
crypto.news: Blockstream says it will not pay ransom for stolen Liquid BitcoinSeptember 2026
Block production resumes about 12:26 UTC without user transactions; SideSwap trading reopens; peg-outs stay suspended; reserves cover about 85% of L-BTC supply.
L-BTC resumes trading with reserves covering just 85% of supply - CryptoSlate6 September 2026
Attack begins about 13:52 UTC; about 3,998.5 unbacked L-BTC minted at 13:53:10 UTC; peg-out via SideSwap at 14:06 UTC; about 3,996 BTC paid out at 14:28:56 UTC; reserve falls from about 4,205 BTC to about 197-207 BTC.
TRM Labs: 2026's Biggest Hack to Date — Liquid Network7 September 2026
About 16:09:25 UTC attackers return 3,400 BTC to the Liquid federation peg wallet, retaining about 598.5 BTC as a self-declared bounty.
CoinDesk: White-Hat Hackers Return Most of $320M Bitcoin Taken from Liquid Network (September 8, 2026)11 September 2026
Blockstream publicly refuses the 10% bounty demand and vows to pursue the remaining about 598.5 BTC with law enforcement and forensic firms.
'Return the bitcoin': Blockstream refuses ransom demand for remaining 600 BTC from Liquid exploit - The BlockDecision Log
- slot 446154672 · hash 8wX1s29NSXoR5ZGF35DTUWTp6F4LbCR2QHc6MtxRzU65
This investigation is cryptographically anchored to the Solana blockchain (1 decision). 21 of 25 cited source URLs have an Internet Archive snapshot.
model: claude-code-merge-writer
generated: 9/11/2026, 12:14:37 PM
last updated: 10/26/2026, 6:19:31 PM
5 viewsavoid.net — verified advice for a post-truth world