The Liquid Network Exploit Explained

Video transcript

A cache bug in Liquid's node software let an attacker mint about 4,000 unbacked L-BTC. No contract failed and no key was stolen.

Through SideSwap's peg-out, federation signers released 3,996 BTC, worth about 320 million dollars at the time, per The Block.

Elements caches the results of costly rangeproof checks on Liquid's hidden amounts. In Blockstream's words, a cache hit skips verification entirely.

A 2018 change dropped two fields from the cache key. The August fix added them without length prefixes, so inputs could collide. The attacker's fake proof matched a genuine cached key.

The flawed fix went public on September 1, and the exploit came five days later. The attacker returned 3,400 BTC the next day, leaving about 602 BTC outstanding. The peg was restored November 2.

The weak point was the node, not a contract. Bug A hid for eight years, its fix was new code no reviewer caught, and publishing it exposed the flaw.

Testing checked the fix against the known bug only. Blockstream now plans independent review of critical fixes, more fuzzing and a bug bounty.

Guardian's Managed Security runs Helix, its AI auditor, continuously across your stack, onchain and off. Only human-verified findings reach you, with a 90-day guarantee.

Read the full article, or talk to Guardian at guardian.security about testing the code beneath your contracts.

Liquid is a Bitcoin sidechain run by a federation. The bitcoin the federation holds backs L-BTC, the sidechain's version of BTC.

On September 6, 2026, that backing broke. No smart contract failed and no key was stolen. The bug sat in Elements, the open-source software Liquid nodes run.

Here is what happened, how the bug worked, and what it shows about testing the software beneath your contracts.

What Happened

At 13:53 UTC, a transaction in Liquid block 4,050,336 created about 4,000 L-BTC "with no bitcoin behind it," Blockstream's incident assessment says.

The attacker sent the tokens to SideSwap's peg-out service. It burned them under a valid authorization, and at 14:28 UTC the federation's signers released 3,996.02 BTC on Bitcoin.

SideSwap said its systems and its peg-out key were not compromised. Blockstream traced the L-BTC to a bug in Elements, The Block reported.

With smaller peg-outs that confirmed before the halt, Liquid's reserve fell from about 4,205 BTC to 197 BTC, according to Blockstream.

The Bug: A Cache That Skipped Proofs

Liquid hides amounts. Each confidential output carries a rangeproof, a zero-knowledge proof that its hidden value is in a valid range.

Checking these proofs is expensive. So Elements caches results "to avoid re-verifying identical proofs across mempool and block validation," Blockstream wrote.

The risk is what a cache hit means. In Blockstream's words, "a cache hit skips verification entirely."

Two bugs, one fix apart

• Bug A (2018): a change merged into Elements v0.14.1 dropped the asset commitment and scriptPubKey from the cache key.
• The report: external researcher stutxo reported Bug A on August 2, 2026, with two proposed fixes.
• The fix: Blockstream chose direct byte concatenation over the length-prefixed option.
• Rollout: bridge nodes had it on August 3; 13 of 15 functionaries by August 11.
• Bug B: the fix added the missing fields but wrote raw bytes "without length prefixing or separators."

Without boundaries between fields, different inputs can produce the same key. The attacker crafted a fake proof whose key bytes matched a genuine entry already in the cache.

Nodes found the entry and never checked the proof. "Bug B allowed it to pass validation," Blockstream wrote.

The Bug A fix was published in the Elements repository on September 1. From then, Blockstream notes, the code containing Bug B was public. The exploit came five days later.

Timeline and Loss

Times are UTC, from Blockstream's assessment unless noted.

• Sep 6, 13:53: the exploit transaction creates about 4,000 unbacked L-BTC.
• Sep 6, 14:10: Blockstream's monitoring reports a block-production stall internally.
• Sep 6, 14:28: federation signers release 3,996.02 BTC.
• Sep 6, 18:26: Blockstream coordinates halting Liquid's bridge nodes; exchanges are asked to pause L-BTC.
• Sep 6, 18:30: the attacker posts onchain: "we are whitehats. contact us on chain."
• Sep 7, 01:09: an interim patch reaches the bridge nodes.
• Sep 7, 16:09: the attacker returns 3,400 BTC to the federation's peg wallet.
• Sep 9: Elements v23.3.4 ships the root-cause fix, and block production resumes.
• Nov 2: the peg and 1:1 backing are restored, Blockstream's quarterly update says.

The withdrawal was worth about $320 million at the time, The Block and Cointelegraph reported. Blockstream's report gives amounts in BTC only.

The attacker had told Blockstream to "fix the bug first" and patch every node before returning funds, The Block reported.

The 3,400 BTC returned was about 85% of the withdrawal, The Block noted. Blockstream lists about 602 BTC as outstanding, "subject to ongoing recovery efforts."

For context, see our analysis of stolen crypto recovery rates and our ranking of the biggest bridge hacks.

What It Shows

First, the weak point was the node, not a contract. A contract audit does not review a chain's validation code.

Second, old shortcuts carry risk. Bug A came from a 2018 change to a performance cache and sat in consensus code for eight years.

Third, a fix is new code. Blockstream says "no reviewer, internal or external, identified this risk prior to exploitation."

Its testnet test checked the fix against the known bug only. The collision mode "was therefore not within the scope of testing."

Fourth, publishing a fix publishes the code around it. Bug B was public for five days before it was used.

Fifth, operational limits set the size of a loss. SideSwap acknowledged an online peg-out signing key and no size or velocity limits, per Blockstream.

Blockstream's planned changes show what testing was missing.

• Review by an independent security auditor before critical fixes ship.
• A security scan on every change merged into a release branch.
• More fuzzing, mutation testing and symbolic execution of consensus code.
• Zero-cache re-verification and collision-search tools, made permanent where appropriate.
• A bug bounty program for Elements and other open-source infrastructure.

One reviewer on the fix's pull request put it plainly: "A fuzz oracle to test the combinations with and without cache could help catching these problems next time."

How Managed Security Tests for This

Guardian's Managed Security cites this exploit under continuous vulnerability testing: "Our AI agents spend billions of tokens continuously auditing your entire stack."

Here is how the site describes that work.

• Helix: Guardian's AI auditor runs continuously across your contracts, backend, infrastructure and web app.
• Coverage: "your full stack, onchain and off," not contracts alone.
• Findings: only human-verified findings reach you, each with a fix PR.
• Patches: Guardian engineers who know your stack prepare the patches with you.
• Disclosures: advisories are matched to what you run, and an engineer confirms any exposure.

It is backed by a 90-day guarantee: Guardian detects and resolves a high-severity issue in the first 90 days, or you don't pay.

Frequently Asked Questions

What caused the Liquid Network exploit?

A flaw in the rangeproof verification cache of Elements, Liquid's node software. An August 2026 fix built cache keys without length prefixes, so a crafted proof matched a cached valid one and skipped verification, Blockstream says.

How much was taken in the Liquid Network exploit?

The attacker pegged out 3,996.02 BTC, worth about $320 million at the time per The Block. It returned 3,400 BTC on September 7, and Blockstream lists about 602 BTC as outstanding.

Was a smart contract or a key compromised?

No. The bug was in Elements, Liquid's node software. SideSwap said its systems and its peg-out key were not compromised; the key processed what looked like a valid customer order.

Is Liquid's peg working again?

Yes. In its November 5 update, Blockstream said that as of November 2 it had restored the Liquid peg and 1:1 backing, after new security measures and an independent external security audit.

Sources

• Blockstream: Liquid Network Security Incident Assessment (September 23, 2026)
• Blockstream: Blockstream Quarterly Update, Q3 2026 (November 5, 2026)
• ElementsProject on GitHub: PR #1600, sigcache: harden range proof cache keys and add -norangeproofcache option (September 8, 2026)
• ElementsProject on GitHub: Elements releases, including elements-23.3.4 (September 9, 2026)
• The Block: Liquid Network attacker returns 3,400 BTC after bug fix, retains nearly 600 BTC (September 7, 2026)
• Cointelegraph: Bitcoin sidechain Liquid pauses after purported "white hats" withdraw $320M in BTC (September 7, 2026)
• Guardian: Managed Security