# Liquid Network (Elements rangeproof cache) exploit: Elements bug let attacker mint ~4,000 unbacked LBTC and withdraw ~$320M in BTC; backing restored Nov 2026
Source page: https://vaultx.llc/hacks/liquid-network-exploit-2024 · VaultX incident report by Sentinel · first published 2026-11-03, updated 2026-11-03
- Date: 2026-09-06
- Reported loss: $320M (reported ~$320M at the time (~4,000 BTC; sources range 3,996-4,019.4 BTC). About 3,400 BTC was reportedly returned; ~598.5-600 BTC (~$46-50M at later prices) was reportedly kept by the attacker. Not confirmed by a primary on-chain audit in the research.)
- Attribution: Unknown. According to Galaxy, the attacker left an OP_RETURN message saying 'we are whitehats. contact us on chain.' No real-world person or group has been publicly identified, and the white-hat claim is unverified.
- Chains: Liquid Network (Bitcoin sidechain), Bitcoin
- Status: contained
- Severity: 78/100
- Response score: 62/100 (Operations were paused quickly, the incident was disclosed and a staged recovery with swap options followed, and 1:1 backing was restored in about two months; against that, withdrawals stayed restricted, users criticized the handling, who funded the shortfall is unclear, and no formal compensation is confirmed.)
On 6 September 2026 an attacker reportedly exploited a rangeproof-verification caching bug in Elements, the software behind the Liquid Network. They minted about 4,000 unbacked LBTC and redeemed it for real BTC through the peg-out path. According to reports, about 3,400 BTC was returned the next day and roughly 600 BTC was kept. Liquid said on 2-3 November 2026 that 1:1 backing was restored after a final 250 BTC transfer, though direct federation withdrawals reportedly remained restricted.

**What happened**
According to Blockstream's incident assessment, an attacker exploited a flaw in Elements, the node software underpinning the Liquid Network. The flaw let a transaction pass validation even though its output value was not backed by its inputs. The attacker used this to create about 4,000 LBTC without backing.
The attacker then reportedly used Liquid's withdrawal/peg-out path, associated in reports with SideSwap and related federation infrastructure, to convert the unbacked LBTC into real BTC. Reports put the BTC drained at roughly 3,996 to 4,019.4 BTC, depending on whether fees and rounding are included. That was about $320M at the time and, per one report, roughly 95% of the federation wallet's balance.
Liquid paused network operations and peg-outs. The attacker reportedly returned about 3,400 BTC the next day and kept roughly 598.5-600 BTC. Over the following weeks Liquid resumed block production and ran a staged recovery. Supported swap providers let users convert between BTC and LBTC at 1:1 while direct federation peg-outs stayed under 'enhanced operational controls'. On 2-3 November 2026 Liquid said full 1:1 backing was restored after a final 250 BTC transfer.

**How it worked**
Liquid is a Bitcoin sidechain where LBTC represents BTC held by a federation. Liquid uses confidential transactions, in which amounts are hidden and rangeproofs prove that values are valid. According to Blockstream, a bug in the rangeproof verification cache let an invalid transaction be accepted as valid. This effectively allowed 'inflation' of LBTC with no matching BTC reserve.
The attacker then redeemed the fake LBTC for real BTC held in the federation's reserves through the peg-out process. Reports say federation private keys were not compromised. The flaw was in software validation, not in key custody. The loss was a reserve shortfall: LBTC in circulation exceeded the BTC backing it.

**Where the money went**
Per Galaxy and others, the BTC was drained through a federation/peg-out path associated with SideSwap and consolidated into a single attacker-controlled address (reportedly ending in '6gyqjlte'; the full address is not given in the research). About 3,400 BTC was returned the day after the exploit. Chainalysis reportedly says the remaining ~600 BTC went as change to an actor-controlled address in the same transaction, and later coverage says it sat at the attacker's address for some time. One summary (The Defiant) claims later use of DEX swaps, Tornado Cash and no-KYC exchanges, but stronger sources do not corroborate this, so treat it as unconfirmed. The research shows no exchange or bridge freezes. Recovery came from the attacker's partial return and from reserve top-ups.

**The response**
Liquid paused operations and peg-outs quickly, resumed block production in stages, and enabled 1:1 BTC/LBTC swaps through supported providers while keeping direct federation withdrawals restricted. Blockstream published an incident assessment. A COIN360 headline indicates Blockstream rejected a 10% bounty demand from the attacker, but the research gives no further detail. Reserves were fully restored by 2-3 November 2026. Bitcoin Magazine reports that who covered the final shortfall was not publicly identified, while a Crypto Briefing headline says Blockstream moved 300 BTC into Liquid. No formal user compensation program or insurance payout is confirmed. Governance changes were reportedly still forthcoming.

**Impact**
The exploit reportedly removed about 95% of the federation wallet's balance and raised immediate concern about the peg and the sidechain's solvency. Users faced disrupted withdrawals for about two months. Bull Bitcoin customers reportedly could not convert LBTC to BTC, and some users looked for costlier ways out. The research gives no quantified BTC or token price reaction. Coverage later shifted to the restoration of backing.

**Wallets linked to this case**
- bc1qgslsydz56d0ed6827hdemfmk5w2f6ldyc6wt7p (Bitcoin, recipient (federation payout recipient, per CertiK as report) source: https://www.certik.com/blog/liquid-network-incident-analysis
- bc1ql4mfu6aundtkksxklfajs2h3t9nzcd6gyqjlte (Bitcoin, recipient (another recipient / consolidation address, per Ce) source: https://www.certik.com/blog/liquid-network-incident-analysis
- bc1qdlld6antmv4xug242ed83q7k4rqw50cwfns38szx4qu2f4jwaxxsuhwxxr (Bitcoin, Liquid Federation peg wallet (victim, per CertiK as reported) source: https://www.certik.com/blog/liquid-network-incident-analysis

**Timeline**
- 2026-09-06 Attacker reportedly mints ~4,000 unbacked LBTC via the Elements rangeproof cache bug and pegs out ~$320M in BTC; Liquid pauses operations and peg-outs.
- 2026-09-07 Attacker reportedly returns ~3,400 BTC and keeps ~598.5-600 BTC; Galaxy reports an OP_RETURN message claiming white-hat status.
- 2026-09 (late) Bull Bitcoin reportedly says its customers cannot convert LBTC back to BTC on its platform; some users criticize the handling of the crisis.
- 2026-09/10 (exact date not given) Liquid resumes block production but keeps direct peg-outs restricted; swap providers such as SideSwap reportedly allow 1:1 BTC/LBTC conversion.
- 2026-10/11 (exact date not given) A report (Crypto Briefing via TradingView) says Blockstream moved 300 BTC into Liquid, cutting the reserve shortfall to 250 BTC.
- 2026-11-02 Liquid federation says reserves are fully restored after a final 250 BTC transfer.
- 2026-11-03 CoinDesk and others report that LBTC is fully backed 1:1 again.

**How to protect yourself**
- Wrapped or sidechain assets such as LBTC depend on the validation code and the federation, not only on the underlying BTC; a software bug can create unbacked tokens without any key theft.
- Check how and when a peg can be redeemed and whether withdrawals can be paused. Do not hold more in a sidechain than you can tolerate being temporarily illiquid.
- Builders should treat verification caches and optimizations in consensus-critical code as high-risk, and should use differential testing, fuzzing and independent audits of validation paths.
- Treat a 'white hat' claim by an attacker skeptically until independently verified; keeping ~$46-50M is not a standard white-hat outcome.
- Monitor reserve-versus-supply attestations. A gap between circulating LBTC and BTC held is the key warning signal.

**Still unknown**
- The attacker's real identity, and whether the 'white hat' claim is genuine.
- The exact amount stolen (3,996 to 4,019.4 BTC reported) and the exact amount kept (~598.5 to 600 BTC).
- The full attacker address (only a partial suffix, '6gyqjlte', appears in the research) and what happened to the ~600 BTC retained.
- The date of the Elements/Liquid report in some sources: later research notes say 2024, but the primary notes and the 'two months after' context point to 6 September 2026, which this report uses.
- Who funded the final 250 BTC top-up and the other top-ups, and on what terms.
- Whether any law-enforcement investigation exists, and whether any funds were frozen.
- Whether the Tornado Cash and no-KYC exchange laundering claim is true.
- When direct federation peg-outs will fully resume, and what governance changes are planned.

**Sources**
- Blockstream: Liquid Network security incident assessment https://blog.blockstream.com/liquid-network-security-incident-assessment/
- CoinDesk: Liquid's bitcoin IOUs are fully backed again after a $320M exploit https://www.coindesk.com/markets/2026/11/03/liquid-s-bitcoin-ious-are-fully-backed-again-after-a-usd320-million-exploit
- Bitcoin.com: Liquid Network restores its bitcoin reserves https://news.bitcoin.com/blockchain/good-news-finally-liquid-network-restores-its-bitcoin-reserves/
- Galaxy: Liquid Network exploit analysis https://www.galaxy.com/insights/research/liquid-network-exploit-4000-btc-bitcoin-sidechain-blockstream-white-hat
- COIN360: Blockstream rejects Liquid hackers' 10% bounty demand https://coin360.com/news/blockstream-rejects-liquid-hackers-10-bounty-demand
- Crypto Briefing via TradingView: Blockstreammoves 300 BTC into Liquid, cutting reserve shortfall to 250 BTC https://tradingview.com/news/cryptobriefing:1f777e97f094b:0-blockstream-moves-300-btc-into-liquid-cutting-reserve-shortfall-to-250-btc/
- Bitcoin Magazine: Liquid Network announces recovery https://bitcoinmagazine.com/news/liquid-network-announces-recovery
- Chainalysis: $320M exploit of Liquid Network https://www.chainalysis.com/blog/320m-exploit-liquid-network/
- Nexus Mutual: Liquid Network incident report https://nexusmutual.io/blog/liquid-network-incident-report
- The Defiant: Liquid restores full Bitcoin backing after Elements exploit https://thedefiant.io/news/security/liquid-restores-full-bitcoin-backing-after-elements-exploit
- Liquid Network security incident assessment (Blockstream/Liquid) https://blog.liquid.net/liquid-network-security-incident-assessment/
- Liquid Network staged recovery update (Liquid blog) https://blog.liquid.net/liquid-network-staged-recovery-update/
- CoinDesk: Liquid's bitcoin IOUs are fully backed again after a $320M exploit https://www.coindesk.com/markets/2026/11/03/liquid-s-bitcoin-ious-are-fully-backed-again-after -a-usd320-million-exploit
- HappyCoin: Adam Back on Liquid recovery https://happycoin.news/en/adam-back-liquid-recovery-320m-hack/
- Reuters: Bitcoin-based Liquid Network says $320 million withdrawn in hack https://www.reuters.com/technology/bitcoin-based-liquid-network-says-320-million-withdrawn-hack-2026-09-07/
- The Block: Liquid Network restores full bitcoin backing following exploit https://www.theblock.co/news/ecosystems/2026-11-03-liquid-network-restores-full-bitcoin-backing-following-exploit-432387
- CoinDesk: Bitcoin network used by exchanges hit by $320M exploit, hackers claim they're the good guys https://www.coindesk.com/markets/2026/09/07/bitcoin-network-used-by-exchanges-hit-by-usd320-million-exploit-hackers-claim-they-re-the-good-guys
- CertiK: Liquid Network incident analysis https://www.certik.com/blog/liquid-network-incident-analysis
- Crypto.news: Liquid Network restores bitcoin reserves after exploit https://crypto.news/liquid-network-restores-bitcoin-reserves-exploit/
- finance.yahoo.com https://finance.yahoo.com/markets/crypto/articles/liquid-network-restores-full-bitcoin-112210757.html

---
VaultX: free crypto news and intelligence, https://vaultx.llc