Liquid Network recovers 3,400 BTC in security incident, attributes breach to Elements cache validation flaw

Chainthink

Release Time: 2026/09/09 02:55:19

BTC

$78,767.50-0.13%

Summary

The Liquid Network recovered 3,400 BTC following a security incident caused by a cache validation flaw in Elements, which enabled attackers to mint 4,000 LBTC—valued at $320 million—on September 6. The narrative of BTC as a hedge against inflation suffered a blow as Liquid’s reserves fell from 4,205 BTC to 197 BTC before partial recovery. Blockstream has deployed a patch and is in discussions with the attacker, who claims to be a white-hat researcher. MiCA (EU Markets in Crypto-Assets Regulation) compliance may come under renewed scrutiny as a new version of Elements (v23.3.4) is scheduled for release within 48 hours to stabilize the network.

The Liquid Network released a security incident report stating that on September 6, a vulnerability in its underlying open-source software, Elements, was exploited, allowing an attacker to mint approximately 4,000 LBTC without BTC reserve backing (valued at around $320 million), which were then converted to BTC and withdrawn via SideSwap.

The incident caused Liquid's reserves to drop from approximately 4,205 BTC to 197 BTC. The report indicated that the vulnerability stemmed from a cache validation issue in Elements, not a private key compromise; other assets, such as USDT, were unaffected.

Blockstream deployed a patch to the cross-chain nodes on September 7; the vulnerability has been fixed, but the network remains paused. The attacker claims to be a white-hat security researcher.

Currently, 3,400 BTC (approximately $272 million) have been returned to the pegged wallet, while approximately 598.5 BTC (around $47.88 million) remain unrecovered, and Blockstream is currently negotiating with the parties involved.

Blockstream expects to release an emergency version of Elements (v23.3.4) within 48 hours and proceed with network recovery.

Previously, on September 7, it announced that the attacker withdrew approximately 4,000 bitcoins from the Liquid Federation wallet.

Source:Show original

Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information. Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.