SideSwap
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·5VF2TZ…oKKJSummary
SideSwap is an open-source, non-custodial peer-to-peer trading platform and wallet built on Blockstream's Liquid Network, founded in 2020 by Scott Millar. On September 6, 2026, SideSwap's Peg-out Authorization Key (PAK) was the mechanism through which approximately 3,996 real BTC — worth roughly $320 million — was released from the Liquid federation reserve in a single transaction, following an Elements software vulnerability that allowed the minting of unbacked L-BTC. SideSwap's own post-mortem acknowledged operational oversights including keeping its PAK key connected to the internet at all times and running no size, velocity, or origin checks on peg-out orders, though the underlying vulnerability originated in the open-source Elements codebase maintained by Blockstream.
Connected Entities
1 entitiesTimeline(9 events)
1 January 2020
SideSwap founded by Scott Millar (approximate year; exact date not publicly confirmed).
BlockDyor SideSwap Review 20266 September 2026
At 15:53:10 UTC (Liquid block 4,050,336), a vulnerability in the Elements software cache is exploited. Approximately 4,000 unbacked L-BTC are minted via a rangeproof cache-key collision.
Liquid Network Incident Report — @Liquid_BTC6 September 2026
At approximately 14:28 UTC, 3,996 BTC exits the Liquid federation reserve in a single transaction through SideSwap's PAK, collapsing reserves from ~4,205 BTC to ~202 BTC. Liquid Network halts transaction processing.
Liquid Network drained of $320M in cache bug exploit — Crypto.news7 September 2026
Blockstream deploys emergency patch to bridge nodes at 01:09 UTC. Attackers communicate via Bitcoin OP_RETURN messages, identifying themselves as 'whitehats' and stating they will return funds after the vulnerability is fixed.
Liquid Network Incident Report — @Liquid_BTC7 September 2026
At block 965,950, 3,400 BTC is returned to the Liquid federation peg wallet by the actors. Approximately 598.5 BTC is retained.
Liquid sidechain exploiters mint $318.7 million in L-BTC, return 3,400 BTC — Coin Turk8 September 2026
Liquid Network publishes formal incident report. Ledger CTO Charles Guillemet publicly challenges the 'whitehat' characterization, comparing the incident to prior exploits where funds were moved before communication.
Ledger CTO Challenges 'Whitehat' Claim — Blockonomi9 September 2026
SideSwap releases a post-mortem acknowledging operational oversights: PAK key kept online at all times, automatic same-block payouts with no human review, and no size, velocity, or origin checks on peg-out orders.
Liquid Network Resumes Operations After $320M Security Breach — Crypto Economy10 September 2026
Liquid Network resumes controlled block production at 12:26 UTC. Peg-in and peg-out operations remain suspended. Adam Back states Blockstream will cover the 1:1 L-BTC to BTC peg.
Liquid Network Restarts After $320M Exploit — CryptoTimes11 September 2026
Blockstream publicly refuses the actors' demand for a 10% bounty (approximately 59.85 BTC) as a condition for returning the remaining 598.5 BTC, stating it will pursue all lawful recovery avenues.
Blockstream Rejects 10% Bounty Demand — CryptoTimesDecision Log
- hash: KZgRb6CQDfFfmFtaDRo5faxpwaNBqMAPXNqsLrnLgiv
This investigation is cryptographically anchored to the Solana blockchain (1 event). 7 of 20 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 9/11/2026, 12:19:18 PM
last updated: 9/11/2026, 4:40:57 PM
avoid.net — verified advice for a post-truth world