SlowMist details Liquid Network exploit, attacker mints 3,998 L-BTC in largest Bitcoin sidechain hack of 2026
A significant security breach in Blockstream's Liquid Network has led to the minting of nearly 4,000 unbacked L-BTC, resulting in a staggering loss of approximately $320 million. This incident not only highlights vulnerabilities in Bitcoin sidechains but also raises critical questions about the security of interconnected blockchain systems.
What Happened? An Overview of the Liquid Network Exploit
On September 6, 2026, a major exploit was discovered in Blockstream's Liquid Network, a Bitcoin sidechain designed to facilitate faster and more private transactions. This exploit allowed an attacker to create 3,998.5 L-BTC, a token representing Bitcoin on the Liquid Network, without any actual Bitcoin backing it. The attacker then converted these tokens into real Bitcoin, draining around 95% of the Liquid Federation's reserves, which amounted to approximately $320 million.
The Liquid Federation is a group of entities that manage the Liquid Network, ensuring that the tokens issued on this sidechain are backed by actual Bitcoin held in reserve. However, due to a software bug, the attacker was able to bypass the verification process, minting tokens that did not correspond to any real assets. This incident marks the largest publicly disclosed security breach involving a Bitcoin sidechain in 2026.
Understanding the Technical Flaw Behind the Attack
The root cause of this exploit was a vulnerability in the cache key management within Blockstream's Elements software. Specifically, a cache key collision occurred during the range-proof verification process. Range proofs are cryptographic mechanisms that confirm transaction amounts are valid without revealing the exact values, which is essential for maintaining privacy on the Liquid Network.
In an attempt to speed up transaction verification, the Elements software cached previously validated proofs. However, the method of generating cache keys did not include length prefixes, leading to the possibility that two different inputs could produce the same cache key. This flaw allowed the attacker to present an invalid proof that the system mistakenly recognized as valid, enabling them to mint unbacked L-BTC.
Immediate Consequences and Network Response
Upon discovering the exploit, Blockstream acted swiftly to mitigate further losses. They suspended peg operations, halting any additional outflows of Bitcoin from the Liquid Federation. Additionally, the network's block production was paused for four days while the team worked on a patch to address the vulnerability.