Liquid Network, a Bitcoin layer-2 sidechain developed by Blockstream, suffered a major security breach when an attacker exploited a caching vulnerability in the Elements software to mint unbacked L-BTC. According to Blockstream and blockchain data analysis, the attacker subsequently returned 3,400 of the stolen bitcoins while retaining 598.5 BTC as a commission, leaving the network’s federation reserves heavily depleted and bridging operations indefinitely suspended.
The Elements Software Vulnerability and Reserve Depletion
The security incident began on Sunday, September 6, when a range-proof caching bug within Elements—the open-source blockchain platform powering Liquid Network—allowed the creation of L-BTC tokens without the requisite native Bitcoin locked in reserve. According to technical disclosures from Blockstream, the attacker initially tested the exploit with roughly 2 BTC before executing a larger transaction that generated phantom L-BTC. These unauthorized assets were converted into native Bitcoin via the SideSwap outflow service, driving the federation’s reserve down from nearly 4,200 BTC to just 197 BTC. Blockstream confirmed that private keys remained secure and uncompromised, as the breach targeted token issuance logic rather than cold storage vaults.
Partial Restitution and On-Chain Negotiations
Following the breach, Blockstream patched the caching bug, updated its network nodes, and communicated with the attacker that the network environment was secure for fund returns. According to on-chain transaction data verified on mempool.space, the attacker returned 3,400 BTC to the Liquid Network federation address on Monday, September 7. However, the attacker withheld 598.5 BTC—representing roughly 15 percent of the total stolen funds—as a self-designated fee. Charles Guillemet, chief technology officer at Ledger, disputed the attacker’s “whitehat” framing communicated via an on-chain message, stating publicly that an ethical hacker does not drain a bridge before initiating discussions.
Comparative Crypto Hacks and Market Reaction
Broader cryptocurrency markets demonstrated resilience during the incident. Bitcoin (BTC) traded stably, registering a nominal decline of roughly 0.5 percent as investors distinguished between a protocol-level event on a sidechain and the core Bitcoin network. The resolution mirrors historical recovery efforts in decentralized finance exploits, such as Euler Finance recovering nearly all of its $197 million stolen in 2023, while contrasting with Ronin Network’s complete loss of $625 million following its 2022 bridge compromise. As of Monday evening, Liquid Network bridge nodes remain disabled, exchange deposits and withdrawals stay frozen, and Blockstream has not released a definitive timeline for resuming full operations.
Keep reading