Liquid Network lost about 4,000 BTC to a proof cache bug, says Blockstream

What happened

Liquid is a Bitcoin sidechain run by a federation of 15 functionary nodes, built on Blockstream's Elements software. On 6 September 2026 an attacker conjured about 4,000 L-BTC with no BTC behind it, then cashed it out for real BTC through the ordinary peg-out process.

Blockstream published its technical assessment on 23 September. The cause, it says, was a flaw in how Elements cached the results of proof checks. The attacker later sent back 3,400 BTC. According to the assessment, about 602 BTC is still missing.

What is confirmed

All figures below are as stated in Blockstream's assessment, unless marked otherwise. Times are UTC.

Timeline

• 6 September, 13:53. The attacker's transaction is confirmed in a Liquid block. It creates an output that is not backed by its inputs. Nodes accept it.
• 6 September, 14:10. Blockstream's monitoring reports a block production stall.
• 6 September, 14:28. Federation signers release about 3,996 BTC on Bitcoin. A federation member, SideSwap, forwards it onward in the same block.
• 6 September, 18:26. Blockstream coordinates a halt of the Liquid bridge nodes.
• 6 September, 18:30. The attacker posts an on-chain message saying they are whitehats and asking to be contacted on chain.
• 6 September, 20:25. Liquid publicly discloses the incident.
• 7 September, 01:09. An emergency interim patch is deployed.
• 7 September, 16:09. The attacker returns 3,400 BTC to the federation peg wallet.
• 9 September. Elements v23.3.4 is released with the hardened fix. Block production resumes on a corrected chain. Peg operations stay suspended.

Impact

• The Liquid reserve fell from about 4,205 BTC to 197 BTC. That includes smaller peg-outs confirmed before the halt.
• Other Liquid assets, including USDt, were not affected. They were unavailable while the network was paused.
• Blockstream says it verified that no inflation from the bug remains on the current chain.
• As of the assessment's last update (17 September), the staged recovery was still under test and peg operations were still suspended.
• Later reporting. The Defiant, via CryptoBriefing, reported on 11 October that Liquid transactions and block production had resumed on 10 September, but peg-outs were still suspended with the reserve about 603 BTC short, roughly 86% coverage. TokenPost put coverage at 85.8%. Liquid ties a restart to full 1:1 backing, security audits and key-management changes.
• On 17 October, Samson Mow wrote on X that an external audit and Blockstream's internal coordination on funding the roughly 600 BTC gap were running in parallel. He said it was a question of when, not if. ThreatWire has not verified this.

Dollar figures

• The assessment gives BTC amounts only.
• Credora's September review puts the loss at about $320M and the returned part at about $272M. These are Credora's estimates.

How the bug worked

Here is the mechanism in plain words. There is no code and nothing you could use to reproduce it.

Liquid hides transaction amounts. To check that a hidden amount is valid, nodes verify a proof attached to each output. These checks are expensive, so Elements remembers the result of a check it has already done. This is a cache.

The cache works like a lookup key. If a new transaction produces a key that is already in the cache, the node skips the check.

Blockstream describes two bugs:

1. Bug A. An older cache key left out part of the context. It was introduced in 2018. A researcher reported it in August 2026, and a fix went to the bridge nodes on 3 August.
2. Bug B. The fix added the missing fields. But it joined all fields into one key with no separators or length markers. Two different inputs could then produce the same key.

Real transaction   -> checked -> result cached under key K
Crafted transaction -> same key K -> check skipped -> accepted

Once accepted, the unbacked L-BTC looked like any other L-BTC. The peg-out process then paid out real BTC against it.

Blockstream says no reviewer found Bug B before the attack. That includes manual reviews, an AI-assisted review and an external researcher.

The second weakness: the peg-out

According to the assessment, SideSwap later said two things about its own setup:

• Its peg-out signing key was kept online, although the federation charter asks for offline.
• It applied no size limit or review to the peg-out order, which was about 4,000 L-BTC.

The federation member's key was not stolen or forged. The assessment says the peg-out went through because the network had already accepted the fake L-BTC.

What is not known

• Who the attacker is. They described themselves as whitehats on chain.
• Why about 602 BTC has not been returned.
• When peg-outs will resume. The reporting ThreatWire found, up to 17 October, gives no date.
• Who will fund the gap of about 600 BTC. Mow says Blockstream is coordinating it. CriptoNoticias reported that nobody had said who would pay.
• What governance and operational changes the Liquid Federation Board will adopt. The assessment says a review is under way.
• Whether other systems use a similar cache design. Blockstream says it is reviewing this.

Where sources disagree

• Amount outstanding. Blockstream says about 602 BTC. Credora says about 598.5 BTC kept by the attacker. Later coverage gives 598 to 603 BTC.
• Speed of the drain. Credora says one peg-out took about 95% of the reserve within about 22 minutes. Blockstream's timeline shows the order deposited at 14:05 and released at 14:28. That is about 36 minutes after the original transaction.
• Returned amount in dollars. Credora gives about $272M. Blockstream gives no dollar value.
• Date of the loss. Both say 6 September.
• Description of the attacker. Credora calls them self-described white hats. The assessment notes the on-chain message and asks them to return the rest.

Lessons for builders

• Cache keys must be unambiguous. Give every field a length marker. Never join variable-length fields by plain concatenation.
• Do not trust a cached "valid". Re-check the context of a cached proof.
• Check supply against reserves. Credora notes that nothing compared L-BTC supply with BTC held before the peg-out.
• Limit exits. Size caps, delays and manual review for large withdrawals give time to react.
• Keep signing keys offline when the charter says so.
• Review old code. The flaw sat in stable code for years. Review stable consensus code on a schedule.
• Prefer the stronger fix. Blockstream says it will now default to the remediation with the strongest structural safety, even if it is broader.

What users should do

• Check the official Liquid and Blockstream updates for the current state of peg-ins and peg-outs. Peg-outs were reported as suspended as of 17 October.
• Do not follow links in unsolicited messages about refunds or recovery.
• If you use a service that holds L-BTC, check its own notices.

Sources: Blockstream's assessment (as hosted on the Liquid blog), Credora's September 2026 review, and October reporting from CryptoBriefing and TokenPost. Credora's figures are estimates and ThreatWire has not verified them.