A software bug in Blockstream's Elements codebase led to the theft of approximately 3,998.5 L-BTC, valued at roughly $320 million. The exploit, which occurred on September 6, 2026, allowed an attacker to drain 95% of the Liquid Federation's reserves by bypassing range-proof verification.
The vulnerability stemmed from a cache key collision in the verification process. Before version v23.3.4, the software generated cache keys without length prefixes, allowing invalid proofs to be treated as verified. This flaw enabled the unauthorized minting of unbacked L-BTC, which were then converted to Bitcoin.
Following the discovery, Blockstream suspended peg operations and paused network block production until September 10. The company released version v23.3.4, which includes patched cache key management with proper length prefixes. Blockstream confirmed the incident was a software error, not a key compromise.
The attacker communicated via Bitcoin OP_RETURN messages, claiming to be a white-hat researcher and demanding a 10% bounty. Approximately 3,400 BTC were returned to the federation, while the attacker retained about 598.5 BTC, representing roughly 15% of the total stolen funds.
