Skip to main content
AVOID.NET
Sign in

Blockstream Liquid Network

avoid.net/blockstream-liquid-network→32/100·82% conf.
[AI-DRAFTED · AWAITING VERIFICATION]

Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.

anchored·5UuWM3…4jcQ

Summary

The Liquid Network is a Bitcoin sidechain operated by Blockstream via a federated multi-signature custody model, designed for fast, confidential BTC transfers between exchanges and financial institutions. On September 6, 2026, attackers exploited a cache-key collision vulnerability in the open-source Elements software to mint approximately 4,000 unbacked L-BTC and drain roughly $320 million from the federation reserve — one of the largest Bitcoin-adjacent security incidents on record. Attackers claiming to be white-hat researchers subsequently returned approximately 3,400 BTC while retaining ~598.5 BTC (~$47M) as a self-declared bounty; Blockstream publicly rejected the bounty demand and characterized the retention as theft.

Connected Entities

1 entities
Organizations
□Blockstream Liquid Network
Relationships
    Have evidence about Blockstream Liquid Network?
    0
    Accepted
    1
    Under review
    0
    Rejected / revoked

    Community submissions

    Timeline(13 events)

    13 April 2026

    Elements v23.3.3 released — the version running on federation nodes at the time of the exploit, predating the fix for the rangeproof cache vulnerability.

    Liquid Network Incident Report / CertiK analysis

    3 August 2026

    Fix for the rangeproof verification cache-key collision vulnerability committed to the Elements open-source repository.

    CertiK: Liquid Network Incident Analysis

    2 September 2026

    Vulnerability fix merged into the Elements main branch — four days before the exploit.

    CertiK: Liquid Network Incident Analysis

    6 September 2026

    At approximately 13:52 UTC, attacker begins setup transactions against the Liquid Network.

    CertiK: Liquid Network Incident Analysis

    6 September 2026

    At 13:53:10 UTC (block 4,050,336), attacker mints approximately 3,998.5 unbacked L-BTC via the rangeproof cache collision exploit.

    Liquid Network Incident Report (@Liquid_BTC on X)

    6 September 2026

    At 14:06 UTC, attacker submits peg-out request through SideSwap. At 14:28:56 UTC, approximately 3,996 BTC sent to attacker address — total attack duration roughly 36 minutes. Reserve falls from ~4,205 BTC to ~197–202 BTC.

    TRM Labs; CertiK

    6 September 2026

    At approximately 20:25 UTC, Blockstream disables bridge nodes and halts new peg operations after detecting the exploit.

    CryptoTimes

    7 September 2026

    At 01:09 UTC, Blockstream deploys patch to bridge nodes. At approximately 04:49 UTC, block production halted. Attackers communicate via OP_RETURN, claiming to be white-hat researchers.

    CryptoTimes; TRM Labs

    7 September 2026

    At approximately 16:09:25 UTC, attackers return 3,400 BTC to the Liquid Federation peg wallet, retaining approximately 598.5 BTC as a self-declared bounty.

    CertiK; TRM Labs

    8 September 2026

    Liquid Network publishes official incident report via @Liquid_BTC on X detailing the vulnerability, timeline, and response.

    Liquid Network (@Liquid_BTC on X)

    8 September 2026

    Attackers escalate demands, requesting a 10% bounty paid from Blockstream's corporate reserves, threatening permanent 15% loss for L-BTC holders if refused.

    Gizmodo; Blockonomi

    9 September 2026

    Blockstream releases Elements v23.3.4 emergency patch. Adam Back states the LBTC 1:1 peg 'will be covered.' Blockstream publicly rejects the bounty demand, stating it will not pay a ransom.

    crypto.news; CryptoTimes

    10 September 2026

    Liquid Network resumes block production at approximately 12:26 UTC, initially without user transactions. Peg-in and peg-out operations remain suspended pending full reserve recovery.

    CryptoTimes; CryptoBriefing
    Provenance & Audit Trail
    Anchored on SolanaVerify on-chain2 Wayback Archives

    Decision Log

    This investigation is cryptographically anchored to the Solana blockchain (1 event). 2 of 16 cited source URLs have an Internet Archive snapshot.

    full audit log →version history →

    model: claude-sonnet-4-6

    generated: 9/11/2026, 12:14:37 PM

    last updated: 9/11/2026, 4:40:56 PM

    avoid.net — verified advice for a post-truth world