Skip to main content
AVOID.NET
Sign in

Liquid Network

avoid.net/liquid-network→22/100·85% conf.
[AI-DRAFTED · AWAITING VERIFICATION]

Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.

anchored·3SgH6i…gwg8

Summary

Liquid Network is a Bitcoin sidechain developed and operated by Blockstream, secured by a federation of exchanges and institutions. On September 6, 2026, an attacker exploited a cache key collision bug in the Elements codebase to mint approximately 4,000 unbacked L-BTC and redeem them for real Bitcoin via the SideSwap peg-out platform, draining roughly 95% of the Liquid Federation's reserves (about $320 million) in under 40 minutes. The attacker, claiming to be a white-hat, returned about 3,400 BTC after Blockstream patched the bug but retained roughly 598.5 BTC (~$47 million) as a self-declared bounty that Blockstream has publicly refused to honor, leaving the network's reserves under-collateralized and exchanges facing an extended service disruption.

Connected Entities

1 entities
Organizations
□Liquid Network
Relationships
    Have evidence about Liquid Network?

    Timeline(7 events)

    2018

    Blockstream launches the Liquid Network, a federated Bitcoin sidechain for exchanges and institutions.

    TRM Labs

    August 2026

    An earlier, incomplete patch to the Elements cache-key hashing logic is applied, but reportedly does not fully close the boundary condition later exploited.

    CryptoBriefing (SlowMist analysis)

    September 2026

    The complete fix for the cache key collision bug is publicly committed to the Elements GitHub repository with a descriptive commit title, five days before it is exploited in production.

    Scout research summary citing Elements GitHub repository

    6 September 2026

    Attacker mints roughly 4,000 unbacked L-BTC (~13:53 UTC) and redeems them for real Bitcoin via SideSwap (payout ~14:28 UTC), draining about 95% of the Liquid Federation's reserves (~$320 million); Blockstream halts block production and instructs exchanges to suspend L-BTC deposits/withdrawals.

    The Block

    7 September 2026

    Attacker returns approximately 3,400 BTC (~85% of stolen funds) to the Liquid federation wallet after Blockstream patches the vulnerability, retaining roughly 598.5 BTC (~$47 million).

    CoinDesk

    September 2026

    Liquid Network resumes block production and SideSwap reopens trading; federation peg-outs remain suspended, and on-chain reserves cover only about 85% of outstanding L-BTC supply.

    CryptoSlate

    11 September 2026

    Blockstream publicly refuses the attacker's demand for a 10% bounty on recovered funds, calling it extortion and vowing to pursue the remaining ~598.5 BTC with law enforcement and forensic firms.

    The Block
    Provenance & Audit Trail
    Anchored on SolanaVerify on-chain9 Wayback Archives

    Decision Log

    This investigation is cryptographically anchored to the Solana blockchain (1 event). 9 of 13 cited source URLs have an Internet Archive snapshot.

    full audit log →version history →

    model: claude-code-investigator

    generated: 9/12/2026, 5:08:47 PM

    last updated: 9/13/2026, 1:11:40 AM

    avoid.net — verified advice for a post-truth world