Liquid Network Devastated by $320M Software Bug Exploit

A software bug in Blockstream's Elements codebase allowed an attacker to mint nearly 4,000 unbacked L-BTC on Liquid Network, peg them out for real Bitcoin, and drain roughly 95% of the Liquid Federation's reserves in a matter of hours.

The bug, which was caused by a cache key collision vulnerability, was buried in the range-proof verification process. Range proofs are cryptographic checks that confirm transaction amounts fall within valid bounds without revealing exact values.

The attacker exploited this collision to bypass verification, minting L-BTC that had no corresponding Bitcoin backing in the federation's peg wallet. Those freshly minted tokens were then rapidly pegged out, converting them into real BTC on the Bitcoin mainnet before anyone could intervene.

Blockstream moved quickly after discovering the exploit, pausing block production and deploying a patched version of Elements that included proper length prefixes for cache key management.