Liquid Network (Blockstream)
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·4XfiSk…bxaaSummary
Liquid Network is a Bitcoin sidechain operated by Blockstream and a federation of member exchanges, launched in 2018 to enable fast inter-exchange BTC settlement via a pegged asset called L-BTC. On September 6, 2026, attackers exploited a range-proof cache collision vulnerability in the underlying Elements software to mint approximately 4,000 unbacked L-BTC tokens and redeem them for roughly $320 million in real Bitcoin from the federation reserve, representing one of the largest crypto hacks of 2026. Attackers returned approximately 85% of funds after the vulnerability was patched, but retained roughly 598.5 BTC (~$47 million) as a self-declared bounty; Blockstream publicly rejected the bounty demand and characterized the retention as theft, not responsible disclosure.
Connected Entities
2 entities- + 7 more
Timeline(9 events)
27 September 2018
Liquid blockchain went live at 1:29 UTC with 23 founding federation members.
Blockstream press release4 September 2026
Attackers began preparatory activity on the Liquid Network, conducting test transactions and seeding the range proof cache with 68 identical range proofs across 14 hours.
Bitquery on-chain analysis6 September 2026
At 13:53 UTC (Liquid block 4,050,336), attackers minted approximately 4,000 unbacked L-BTC by exploiting a range proof cache collision in the Elements software. At 14:28 UTC, the federation processed a 3,996 BTC peg-out via SideSwap, draining approximately $320 million from the reserve. The Liquid Network was paused and bridge nodes disabled. Attackers posted an OP_RETURN message: 'we are whitehats. contact us on chain.'
TRM Labs, Bitquery, Bloomberg7 September 2026
Blockstream deployed an emergency patch to bridge nodes. Attackers returned approximately 3,400 BTC (~$270M, 85% of drained funds) to the federation multisig at 16:09 UTC. Approximately 598.5 BTC (~$47M) was withheld as a self-declared bounty.
TRM Labs, CoinDesk, CryptoBriefing8 September 2026
Security experts including Ledger CTO Charles Guillemet publicly rejected the white hat framing, characterizing the retained $47M as extortion. Bloomberg published analysis on systemic sidechain vulnerabilities exposed by the incident.
Bloomberg, Gizmodo9 September 2026
Elements software version 23.3.4 released with a patch hardening range proof cache keys against concatenation collisions.
Bitquery on-chain analysis10 September 2026
Liquid Network resumed block production at 12:26 UTC in a controlled mode. Peg-in and peg-out operations remained suspended. Blockstream CEO Adam Back publicly pledged that the L-BTC to BTC 1:1 peg would be maintained and covered.
CryptoTimes, CryptoBriefing11 September 2026
Blockstream publicly rejected the attackers' demand for a 10% bounty from company funds, characterizing the retention of 598.5 BTC as theft rather than responsible disclosure and stating 'We will not pay.'
CryptoPotato, multiple outletsDecision Log
- hash: 8dt92xn1AADtEmEuWzXjAmkBC6iSDTNRgZLPwvzCZmgW
This investigation is cryptographically anchored to the Solana blockchain (1 event). 9 of 17 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 9/11/2026, 12:06:03 PM
last updated: 9/11/2026, 4:40:56 PM
avoid.net — verified advice for a post-truth world