Liquid

2026

LIQUID

when

<h2 id="b-tldr-b">TLDR:</h2><ul><li style="font-weight: 400">Liquid Network exploit minted 4,000 unbacked LBTC via a range proof caching flaw.</li><li style="font-weight: 400">Attackers used SideSwap’s peg-out authorization to convert fake LBTC into real bitcoin.&nbsp;</li><li style="font-weight: 400">Blockstream patched the bug and recovered 3,400 BTC; 598.5 BTC remains outstanding.&nbsp;</li><li style="font-weight: 400">Elements v23.3.4 emergency release expected within 48 hours to restore full network function.</li></ul>The Liquid Network suffered a major security breach on September 6, 2026, after attackers exploited a flaw in its Elements software. The exploit allowed roughly 4,000 unbacked LBTC tokens to be minted and converted into real bitcoin through the network’s peg-out system. <a href="https://blockonomi.com/blockstream/" rel="noopener noreferrer nofollow">Blockstream</a> confirmed the Liquid Federation has since recovered most of the stolen funds, though the network remains offline while a patch is finalized.<h2 id="b-how-the-liquid-network-exploit-unfolded-b">How the Liquid Network Exploit Unfolded</h2>The incident occurred at Liquid block 4,050,336, when a vulnerability in range proof verification caching went unnoticed by the system. This flaw let attackers create LBTC that had no bitcoin reserves backing it. The unbacked tokens were then routed through SideSwap, a Liquid Federation member holding peg-out authorization.Because the validation failure happened before the peg-out request was submitted, SideSwap’s node and the network’s functionaries treated the transaction as legitimate. The peg-out mechanism itself worked exactly as intended, releasing bitcoin to a whitelisted address tied to <a href="https://parameter.io/320m-bitcoin-heist-liquid-network-hackers-return-85-of-stolen-funds/" rel="noopener noreferrer nofollow">SideSwap.</a> From there, the funds were forwarded to an address controlled by the exploiters.Blockstream clarified that no private keys were compromised during the attack. The Liquid Federation’s functionary nodes operated normally throughout the incident. Before the breach, the Liquid reserve held close to 4,205 BTC in total. After the unauthorized peg-outs were processed, that balance dropped sharply to just 197 BTC.Other assets issued on the Liquid Network, including USDT, were not directly affected by the vulnerability. However, those tokens remain temporarily unavailable since the entire network has been paused. In its statement, Liquid Network said the failure came from several factors that “interacted in ways that ultimately defeated the system’s built-in redundancies.”<div class="embed-x"><blockquote class="twitter-tweet">LIQUID NETWORK UPDATE: INCIDENT REPORT Status as of September 8, 2026, 19:10 UTCWhat Happened?On September 6, 2026 at 15:53:10 UTC (Liquid block 4,050,336), a vulnerability in the open-source Elements software related to how Liquid nodes cache range proof verifications was…— Liquid Network <img src="https://s.w.org/images/core/emoji/17.0.2/72x72/1f30a.png" alt="🌊" class="wp-smiley" style="height: 1em; max-height: 1em;"> (@Liquid_BTC) <a href="https://x.com/Liquid_BTC/status/2097404704028545175?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">September 8, 2026</a></blockquote></div><h2 id="b-recovery-efforts-and-network-restoration-plans-b">Recovery Efforts and Network Restoration Plans</h2>Shortly after the exploit, the responsible party left a message on the bitcoin mainchain. They identified themselves as white-hat <a href="https://moneycheck.com/bitcoin-security-audit-uncovers-nearly-5000-critical-flaws-following-coldcard-breach/" rel="noopener noreferrer nofollow">security researchers</a> and asked to coordinate with Blockstream on fixing the vulnerability. This message came before any funds had been returned to the network.Blockstream moved quickly to contain the damage once the exploit was discovered. A patch for the Liquid Network’s bridge nodes was deployed by September 7 at 01:09 UTC. This update closed the vulnerability, preventing any further exploitation of the same flaw.On September 7 at block 965,950, the exploiters returned 3,400 BTC to the Liquid Federation’s peg wallet. That leaves approximately 598.5 BTC, or 15% of the total taken, still outstanding. <a href="https://coincentral.com/cardano-founder-charles-hoskinson-slams-blockstream-quantum-strategy/" rel="noopener noreferrer nofollow">Blockstream</a> said discussions with the individuals involved are continuing in an effort to recover the remaining bitcoin.Blockstream announced that an emergency release of Elements, version 23.3.4, is currently undergoing review. The update is expected within roughly 48 hours of the announcement. Once deployed, functionary operators will apply further adjustments to restore full network operations. Liquid Network users have been told no proactive action is required to protect their existing funds at this time.The post <a href="https://blockonomi.com/liquid-network-exploit-blockstream-recovers-3400-btc-after-400m-bug/" rel="noopener noreferrer nofollow">Liquid Network Exploit: Blockstream Recovers 3,400 BTC After $400M Bug</a> appeared first on <a href="https://blockonomi.com" rel="noopener noreferrer nofollow">Blockonomi</a>.

Liquid Network Exploit: Blockstream Recovers 3,400 BTC After $400M Bug

Table of Contents

Blockonomi

Other articles published on Sep 9, 2026

Iran Embraces Bitcoin and USDT for Trade as US Sanctions Intensify in 2026

Bitcoin: After Investing $176 Million in its STRC Shares, the Strategy Doubles its Buyback Capacity

Hedera sets its transaction fees in dollars and charges them in HBAR

Robinhood Chain Fees Exploded 17X in One Week

DOT touches $1.24 while most of the market sits flat

BNB Chain's BUILDon Gains Momentum With 50% Weekly Surge

Join our free newsletter for daily crypto updates!