Untagged Elements code drained 95% of Liquid's reserve in 23 minutes
Blockstream says none of the 15 federation keys were compromised, which is what makes the $320m peg-out worth studying: honest signers running buggy validation code approved it, and the reserve is still short.
The Investor · Invest desk
What happened
- A single peg-out of 3,996 BTC at 14:28 UTC on Sept. 6, 2026 took Liquid's federation reserve from 4,205 BTC to 202 BTC in less than half a minute, roughly $320 million at prevailing prices.
- The setup was 68 identical range proofs planted over 14 hours between Liquid blocks 4,049,384 and 4,050,246 at 41 satoshis a transaction, each hiding its amount behind a commitment to zero.
- The attacker wrote "we are whitehats" into an OP_RETURN field, returned 3,400 BTC after Blockstream patched its bridge nodes, and kept 598.5 BTC, about $47 million, as a self-declared bounty.
- Liquid halted block production at 04:49 UTC on Sept. 7, exchanges suspended L-BTC deposits and withdrawals, and the network was still frozen at the time of the report.
Why it matters
- What it limits constraint A custody disclosure listing 15 functionaries, hardware security modules and an 11-of-15 quorum cannot answer whether reserves can be counterfeited, because the counterfeiting happened in validation rather than signing, so diligence has to reach which commit the validating nodes run.
- Who's exposed exposure Holders of L-BTC are sitting on a claim of roughly 0.857 BTC per unit on the reserve arithmetic, and the exchange gates that would let them out are shut.
- What it sets up precedent An on-chain negotiation that ends with the finder keeping 15% of what was taken gives the next bridge bug a published reference rate, set without a bounty agreement.
- Who has to decide decision Somebody now has to decide who funds the 603 BTC hole before the chain restarts, and every option is a choice between a vendor expense and a holder haircut.
Next story · Invest · Sep 11
Blockstream bets forensic tracing beats paying a $32m bounty for the last 598.5 BTCConfirmed7 publishers
The custody assurance and the failure sat in different layers. Fifteen functionaries running tamper-proof hardware security modules in an 11-of-15 multisig signed the peg-out that emptied the reserve [7], and by their own lights they signed it correctly, because Blockstream says no federation key was compromised and puts the fault in a cache-key collision in the confidential-transactions verification logic, code that reached the Elements master branch without ever appearing in a tagged release [1]. Elements caches successful range-proof verifications because the check is expensive, and before the patch the cache key came from the proof bytes and the hidden amount without the asset type or the scriptPubKey context, so a proof that was valid in one place could be retrieved and reused where it was not [4].
Priming that cache was cheap: 68 identical proofs at 41 satoshis a transaction is 2,788 satoshis [8], and at the roughly $80,080 a coin implied by $320m against 3,996 BTC [5][11], call it two dollars and twenty cents of fees [12]. (The $47m tag on 598.5 BTC implies about $78,500 a coin [15], so the dollar figures are rounded from different moments and the BTC counts are the ones to work from.)
Then the detection gap. The reserve fell from 4,205 BTC to 202 BTC at 14:28 UTC on Sept 6 [5], block production stopped at 04:49 UTC on Sept 7 [6], and 14 hours and 21 minutes of blocks were produced in between [18]. For anyone who audits by balance, the harder point is that the counterfeit was on the liability side, since the unbacked L-BTC was minted and then pegged out [17], so a reserve attestation would have read a full 4,205 BTC right up to the moment the peg-out cleared [16].
The accounting after the return: 202 plus 3,400 is 3,602 BTC against 4,205 before, leaving the reserve 603 BTC or about 14% short [13], and unless L-BTC supply has been reduced by the same amount, each unit sits on a claim of roughly 0.857 BTC [14]. The peg is quoted at one. The reserve arithmetic says something else.
The generous reading is that the model bent rather than broke, because a stolen key takes all 4,205 BTC with nobody to negotiate with, whereas here nine on-chain messages and a verified PGP key got 3,400 BTC back after the bridge nodes were patched [3][2]. Against that, the 598.5 BTC kept as a self-declared bounty is 15% of what left [10], which is a rate the next finder can now quote, and its legal status is open: the source material frames it as an unresolved question of whether keeping $47m without a formal bounty agreement is theft or security research [19].
What would break the read here is evidence that the drain needed anything from the signers other than honest operation, and on Blockstream's account it did not [1]. Meanwhile the oldest Bitcoin sidechain, running since 2018 for exchanges, traders and tokenised asset issuers [7], is frozen and gated at the exchanges [6], which means it is settling nothing at all while the code question is answered.
What to watch
- Whether Blockstream or the federation funds the 603 BTC gap from its own balance sheet, or leaves L-BTC holders to wear it.
- Whether the 598.5 BTC is settled as a bounty or pursued as theft, and in which jurisdiction that gets tested.
- Whether the federation publishes which Elements commit its validating nodes were running, and whether other Elements-based chains ran the same cache path.
Information, not investment advice. This story is general information about companies and markets, drawn from cited reporting. It is not a recommendation to buy, sell or hold any security; check the cited sources before acting.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+12
- Incentives45
- Confidence58
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Blockstream confirmed no federation keys were compromised, attributing the exploit to a cache-key collision in the confidential transactions verification logic that had entered the Elements master branch but never appeared in a tagged release.
- [2]
The attacker declared "we are whitehats" via Bitcoin OP_RETURN messages and returned 3,400 BTC after Blockstream patched its bridge nodes, keeping 598.5 BTC (about $47 million) as a self-declared bounty.
- [3]
Over roughly 30 hours nine OP_RETURN messages went back and forth between the attacker and Blockstream, a PGP key was verified, and bridge nodes were patched before 3,400 BTC came back.
- [4]
Elements caches successful range-proof verification results because the check is computationally expensive; before the patch the cache key was derived from the proof bytes and hidden amount alone, excluding asset type and scriptPubKey context, so a previously verified proof could be replayed in a context where it should not have been valid.
- [5]
On Sept. 6, 2026, 3,996 BTC left the Liquid federation wallet in a single peg-out transaction at 14:28 UTC, collapsing the reserve from 4,205 BTC to 202 BTC in less than half a minute, roughly $320 million at prevailing prices.
- [6]
The Liquid Network halted block production at 04:49 UTC on Sept. 7, exchanges suspended L-BTC deposits and withdrawals, and the network remains frozen as of the report.
- [7]
Liquid is the oldest Bitcoin sidechain, operated by a federation of 15 functionaries running tamper-proof hardware security modules in an 11-of-15 multisig arrangement, and has processed billions in volume for exchanges, traders and tokenized asset issuers since launching in 2018.
- [8]
The attacker planted 68 identical range proofs across 14 hours between Liquid blocks 4,049,384 and 4,050,246, spending 41 satoshis per transaction, each carrying an OP_RETURN output naming L-BTC with the amount hidden behind a commitment to zero using the simplest possible blinding key.
- [9]
Once the proofs were cached, the attacker constructed an invalid output matching the cache key of a previously valid check at Liquid block 4,050,336, and federation nodes retrieved the cached result and skipped the verification that should have rejected the inflationary output.
- [10]
The 598.5 BTC retained is 15.0% of the 3,996 BTC that left the reserve.
- [11]
The $320 million valuation of the 3,996 BTC peg-out implies a Bitcoin price of about $80,080.
- [12]
The 68 setup transactions at 41 satoshis each cost 2,788 satoshis, or 0.00002788 BTC, about $2.23 at the implied price.
- [13]
With 202 BTC left after the drain and 3,400 BTC returned, the reserve stands at 3,602 BTC against 4,205 BTC before, a shortfall of 603 BTC or about 14.3%.
- [14]
If outstanding L-BTC supply is otherwise unchanged from before the attack, each unit is backed by about 0.857 BTC.
- [15]
Valuing 598.5 BTC at about $47 million implies a Bitcoin price of roughly $78,500, below the $80,080 implied by the $320 million drain figure.
- [16]
Because the roughly 4,000 unbacked L-BTC were minted before being pegged out, a check of the federation reserve balance alone would have shown the full 4,205 BTC until the peg-out transaction cleared at 14:28 UTC.
- [17]
An unknown actor exploited a range-proof verification cache bug in Elements to create roughly 4,000 unbacked L-BTC and peg them out for real Bitcoin on Sept. 6, 2026, draining 95% of Liquid's reserves in 23 minutes.
- [18]
Block production continued for 14 hours and 21 minutes between the 14:28 UTC peg-out on Sept. 6 and the halt at 04:49 UTC on Sept. 7.
- [19]
The incident raised legal questions about whether keeping $47 million without a formal bounty agreement constitutes theft or legitimate security research, and drew comparisons to the 2016 Ethereum DAO hack.
Sources
2 independent publishers whose own reporting we read for this story.
- crypto.newsLiquid Network drained of $320M in cache bug exploit
1 article · September 8, 2026
- techtimes.comLiquid Network Exploit Drained $316M Via Software Bug, Not Stolen Keys
1 article · September 8, 2026
Topics and entities
Topics
- Patch disclosure gap
- Confidential transactions
- Federated sidechains