Liquid Network Drained of $320M in Cache Bug Exploit
On September 6, 2026, an unknown actor exploited a range-proof verification cache bug in Elements to drain $320 million from Liquid Network's federation reserve. The attacker created approximately 4,000 unbacked L-BTC and pegged them out for real Bitcoin, emptying the vault in just 23 minutes.
The mechanism of the exploit relied on a caching optimization in transaction verification logic that left a gap wide enough for someone to mint $320 million. The attacker exploited this by planting 68 identical range proofs across 14 hours between Liquid blocks 4,049,384 and 4,050,246, spending 41 satoshis per transaction.
The incident has reignited debate over federated sidechain trust models, drawing comparisons to the 2016 Ethereum DAO hack. Blockstream confirmed no federation keys were compromised, attributing the exploit to a cache-key collision in the confidential transactions verification logic that had entered the Elements master branch but never appeared in a tagged release.