Technical flaw may explain $320 million Bitcoin loss from Liquid sidechain
What happened
A total of about $320 million worth of Bitcoin left the Liquid sidechain on September 6, 2026. The outflow was triggered when a customer used SideSwap’s peg‑out service to withdraw roughly 4,000 L‑BTC tokens, which were supposed to be backed one‑for‑one by Bitcoin held in Liquid’s reserve vaults.
Key numbers
- ≈ 4,000 L‑BTC requested for peg‑out
- ≈ 3,996 BTC released to the requester
- Value of released Bitcoin ≈ $320 million
Technical explanation
Researchers say a flaw in Liquid’s transaction‑validation cache may have let an invalid confidential transaction pass. Nodes cache the result of range‑proof checks, which verify that hidden transaction amounts stay within allowed limits. The attacker allegedly crafted a transaction whose proof matched a previously cached key, causing the node to skip the verification and accept the inflated output.
Charles Guillemet, a Ledger CTO, confirmed that a crafted cache‑key collision could bypass the range‑proof check, allowing unbacked L‑BTC tokens to be created.
Node divergence
Some federation functionary nodes accepted the exploit and continued building blocks, while other nodes—including those used by the Liquid explorer—rejected the affected block. This split explains why the transaction appears in some views of the blockchain but not in others.
Official statements
Liquid’s official X account said that neither SideSwap’s peg‑out authorization key nor any other federation keys were compromised. Blockstream, the developer of the underlying Elements software, has not confirmed the claim that the buggy code was deployed to federation nodes.
Unverified details
Mononaut, a community member, reported that the bug entered Elements’ master development branch the week before the incident but never appeared in a tagged release. He suggested that federation functionaries ran this untagged code, while other nodes ran a clean version. This account remains unconfirmed by Blockstream.
Why it matters
Liquid is a Bitcoin sidechain that issues L‑BTC tokens backed by real Bitcoin. If unbacked tokens can be created, the sidechain’s reserve can be drained, undermining confidence in the system and potentially affecting users who rely on Liquid for fast, private Bitcoin transfers.
Next steps
The actors who withdrew the Bitcoin describe themselves as white‑hats and have said they will return most of the funds once the bug is fixed across all nodes. No public confirmation of a full return or a completed patch rollout is available yet.
