Liquid's $320M BTC Exploit Reproduced by Alpen Labs' AI in Under an Hour
Liquid's federation released approximately $320 million worth of BTC after accepting L-BTC that lacked Bitcoin backing on September 6, 2026. According to Alpen Labs CEO Simanta Gautam, his AI agents were able to reproduce the flaw in about an hour after being informed of the attack.
The issue arose from a code change on September 1, which concatenated asset generator and output script fields as raw bytes without encoding their boundaries. This allowed a valid seed proof and an invalid target to produce identical cache input, resulting in a successful cache lookup that bypassed the proof check.
A payout limit could have contained this route, but there is no established rule that would preserve normal withdrawals. SideSwap says a 4,000 L-BTC order faced no size or velocity hold before federation signers released roughly 3,996 BTC.