Liquid Network Exploit (September 2026)
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
Summary
On September 6, 2026, attackers exploited a cache-verification bug in Blockstream's open-source Elements software to mint roughly 4,000 unbacked L-BTC on the Liquid Network and peg them out for real Bitcoin via federation member SideSwap, draining approximately 95% of the sidechain's BTC reserves (~$320 million). The attackers, claiming to be white hats, returned about 3,400 BTC (~85%) after a patch was deployed but retained roughly 598.5 BTC (~$47 million) as a self-declared bounty, which Blockstream has refused to authorize, calling it theft. The incident halted Liquid Network operations for several days and renewed scrutiny of the security assumptions underlying federated Bitcoin sidechains used by exchanges.
Connected Entities
1 entitiesTimeline(8 events)
2018
Liquid Network launches, a federated Bitcoin sidechain operated by Blockstream and a consortium of exchanges and infrastructure providers, intended to enable faster settlement and confidential asset transfers pegged to Bitcoin.
DataDrivenInvestor / general reporting6 September 2026
Attackers exploit a range-proof verification caching bug in Elements to mint approximately 4,000 unbacked L-BTC and peg it out for real BTC via federation member SideSwap, draining the federation reserve wallet from roughly 4,200 BTC to about 197 BTC (~95% loss, ~$320 million).
Liquid Network official incident report (X)September 2026
Attackers post an on-chain OP_RETURN message reading 'we are whitehats. contact us on chain,' and Blockstream disables peg-outs and pauses the network.
TRM LabsSeptember 2026
Attackers return approximately 3,400 BTC (~$272 million, ~85% of stolen funds) after Blockstream confirms a patch; roughly 598.5 BTC (~$47 million) is retained by the attackers as a self-declared bounty.
TRM Labs / CoinDesk8 September 2026
Liquid Network publishes a formal incident report detailing the timeline, root cause, and status of the exploit.
Liquid Network official incident report (X)September 2026
Elements v23.3.4, containing a fix for the range-proof caching vulnerability, is deployed across the network.
The BlockSeptember 2026
Liquid Network resumes block production and transactions; peg-outs remain disabled as a precaution.
The Block11 September 2026
Blockstream publicly refuses the attackers' ransom-style demand for the remaining ~598 BTC, stating it will not pay for the return of stolen property and will pursue law enforcement and forensic recovery.
The Blockmodel: claude-code-investigator
generated: 9/13/2026, 11:10:09 PM
last updated: 9/14/2026, 12:09:30 AM
avoid.net — verified advice for a post-truth world