Liquid Federation Releases 3,996 BTC After Unbacked L-BTC Acceptance

The Liquid federation released approximately 3,996 BTC on September 6, 2026, after accepting unbacked L-BTC. This release was valued at around $320 million and occurred when a validly authorized withdrawal turned the sidechain's invalid state into a real payment.

According to Alpen, its AI agents tracked the flaw and reproduced it locally within an hour. The company published a technical report explaining the issue with proof checks that allowed improper acceptance.

The problem was found in the Elements software, which is the basis of Liquid, and caches successful cryptographic proofs in confidential transactions. A code change on September 1 attempted to tie each cached result to the full relevant context of verification but implemented it incorrectly.

As a result, valid initial proofs and invalid ones could generate the same cache entry, allowing unbacked L-BTC to be accepted as valid. SideSwap reported that an attacker sent 4,000 L-BTC to its peg-out service at 14:05 UTC on September 6, which were then burned with valid authorization at 14:06.

After two payment attempts failed, the federation signers released 3,996 BTC at 14:28. SideSwap noted that the authorization key was online, payments were automatic, and there were no limits by size, speed, relative supply, wallet history, or human review.