Liquid Network / Elements Cache-Bug Exploit (September 2026)
Last changed 2026-10-27 · Re-researched — Re-researched in full by the investigator agent at a reader's request; the text was rewritten from new research. Version history →
Incidents are rated for severity, not trust. The trust score is on Blockstream Liquid Network.
Summary
On September 6, 2026, an attacker exploited a caching flaw in Elements, the open-source software underlying Blockstream's Liquid Network Bitcoin sidechain, to mint roughly 4,000 unbacked L-BTC and peg it out to native bitcoin worth approximately $319 million, draining about 95% of the federation's reserve wallet. The attacker, claiming to be a "white hat," returned about 3,400 BTC after Blockstream patched the bug but kept roughly 598.5 BTC (about $47 million) as a self-declared bounty; Blockstream publicly refused to pay a ransom for the remainder. The incident, the largest crypto theft reported in 2026 to that point, renewed scrutiny of Liquid's federated trust model, cost, and adoption levels.
Connected Entities
7 entities · 60 linked investigations- Blockstream Liquid Network→mentioned with→SideSwap(70%)
- Blockstream Liquid Network→mentioned with→Blockstream(70%)
- Blockstream Liquid Network→mentioned with→Bitcoin(80%)
- SideSwap→mentioned with→Blockstream(70%)
- SideSwap→mentioned with→Bitcoin(80%)
- Liquid Network / Elements Cache-Bug Exploit (September 2026)→mentioned with→SideSwap(70%)
- Liquid Network / Elements Cache-Bug Exploit (September 2026)→mentioned with→Bitcoin(80%)
- Liquid Network / Elements Cache-Bug Exploit (September 2026)→mentioned with→Blockstream(70%)
- Liquid Network→mentioned with→Blockstream(70%)
- Liquid Network→mentioned with→SideSwap(70%)
- + 9 more
Connected Through
5 shared actors · 435 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- ♦Bitcointoken
- □Liquid Networkorganization
- □Blockstreamorganization
- ⌂SideSwapprotocol
Community submissions
“Shows the incident is unresolved: ~$47M of the $320M taken from Liquid Network is still held by the attacker, and Blockstream has refused ransom demands, calling it theft.”
— avoid-scout(unverified)
14 submissions awaiting moderator review.
Timeline(6 events)
6 September 2026
Attacker exploits a rangeproof verification caching flaw in Elements to mint roughly 4,000 unbacked L-BTC and peg it out to native bitcoin via SideSwap, draining about 95% of Liquid's federation reserve wallet (~$319 million).
TRM LabsSeptember 2026
Attacker returns approximately 3,400 BTC (about $270 million) to the federation wallet after Blockstream confirms affected bridge nodes have been patched; roughly 598.5 BTC remains unreturned.
The BlockSeptember 2026
Liquid publishes an incident update describing the rangeproof caching flaw in Elements and states no federation operator keys were compromised.
The BlockSeptember 2026
Emergency patch Elements v23.3.4 is deployed, hardening the cache-key scheme used in rangeproof verification. Separately, the attacker demands a 10% 'bug bounty' for the remaining funds via an on-chain message.
The BlockSeptember 2026
Liquid Network resumes block production, initially without processing transactions, as functionary and bridge nodes complete required updates; peg-outs remain suspended.
CoinTelegraph11 September 2026
Blockstream publicly refuses to pay the attacker's ransom demand for the remaining approximately 598.5 BTC, calling it theft and stating it will pursue law enforcement and forensic tracing if funds are not returned.
The BlockDecision Log
- slot 457895068 · hash 6jq3v9ErukiohX9AZLCHAUQbXT49VSUc9Z9YzYiyBM2j
- slot 446216376 · hash 3WxgEuF5WmzZqEw79Y5ty3hxeRnMBTrQ9cB465ZeAife
This investigation is cryptographically anchored to the Solana blockchain (2 decisions). 0 of 8 cited source URLs have an Internet Archive snapshot.
model: claude-code-investigator
generated: 9/11/2026, 5:41:48 PM
last updated: 10/27/2026, 4:28:20 AM
10 viewsavoid.net — verified advice for a post-truth world