Liquid Network 因缓存漏洞让攻击者铸造无支持的比特币而损失 3.2 亿美元

A range-proof cache bug in the Elements codebase let an unknown actor mint unbacked L-BTC, drain 95% of the federation reserve through SideSwap, then negotiate its return on-chain via OP_RETURN messages. The network remains frozen, 598.5 BTC sits in the attacker’s wallet, and the entire federated sidechain model faces the hardest questions it has ever had to answer.

Summary An unknown actor exploited a range-proof verification cache bug in Elements to create roughly 4,000 unbacked L-BTC and peg them out for real Bitcoin on Sept. 6, 2026, draining 95% of Liquid’s reserves in 23 minutes.

The attacker communicated via Bitcoin OP_RETURN messages, declaring “we are whitehats,” and returned 3,400 BTC after Blockstream patched its bridge nodes, while keeping 598.5 BTC (about $47 million) as a self-declared bounty.

Blockstream confirmed no federation keys were compromised, attributing the exploit to a cache-key collision in the confidential transactions verification logic that had entered the Elements master branch but never appeared in a tagged release.

The Liquid Network halted block production at 04:49 UTC on Sept. 7, exchanges suspended L-BTC deposits and withdrawals, and the network remains frozen as of this writing.

The incident has reignited debate over federated sidechain trust models, drawing comparisons to the 2016 Ethereum DAO hack and raising legal questions about whether keeping $47 million without a formal bounty agreement constitutes theft or legitimate security research.

Sunday afternoons are not supposed to feel like bank runs. Yet on Sept. 6, 2026, anyone watching the Liquid Network federation wallet saw something that looked a lot like one: 3,996 BTC leaving in a single peg-out transaction at 14:28 UTC, collapsing the reserve from 4,205 BTC to 202 BTC in less than half a minute. At prevailing prices, that was roughly $320 million. Gone.

What followed over the next 30 hours was one of the strangest episodes in Bitcoin’s history. The person or group behind the drain did not disappear into a mixing service. They wrote “we are whitehats. contact us on chain” in an OP_RETURN field, opening a public negotiation with Blockstream that anyone with a block explorer could read in real time. Nine messages went back and forth. A PGP key was verified. Bridge nodes were patched. And then 3,400 BTC came back, leaving 598.5 BTC, about $47 million, sitting in an address that nobody controls except the attacker.

The mechanics of what happened are technical. The implications are not. Liquid is the oldest Bitcoin sidechain, operated by a federation of 15 functionaries running tamper-proof hardware security modules in an 11-of-15 multisig arrangement. It has processed billions in volume for exchanges, traders, and tokenized asset issuers since its launch in 2018. Now its reserves are short by $47 million, its reputation is in intensive care, and the broader question of whether federated sidechains can be trusted with real money is louder than it has been at any point in the past eight years.

How the range-proof cache bug worked

To understand the exploit, you need to understand how Liquid hides transaction amounts. Liquid uses confidential transactions, a cryptographic scheme where the value in each output is hidden behind a Pedersen commitment. Range proofs verify that the hidden amount falls within an allowed range without revealing what the amount actually is. This is computationally expensive, so Elements, the Bitcoin Core fork that powers Liquid, caches successful verification results for reuse.

The problem was in how the cache stored those results. Before the patch, the cache key was derived from the proof bytes and hidden amount alone. Asset type and scriptPubKey context were not included. That meant a previously verified proof could be replayed in a context where it should not have been valid.

The attacker exploited this by planting 68 identical range proofs across 14 hours between Liquid blocks 4,049,384 and 4,050,246, spending 41 satoshis per transaction. Each carried an OP_RETURN output with L-BTC written plainly but the amount hidden, using a commitment to zero with the simplest possible blinding key. Once those proofs were cached, the attacker constructed an invalid output that matched the cache key of a previously valid check. Federation nodes retrieved the cached result and skipped the verification that should have rejected the inflationary output.

At Liquid block 4,050,336, the attacker created approximately 3,996 L-BTC out of nothing. Those tokens looked valid to every federation functionary running the vulnerable code. The attacker sent them to SideSwap’s peg-out service, which burned the L-BTC and requested payment from the federation. The federation obliged, releasing 3,996.0183 BTC to the attacker’s Bitcoin address.

JUST IN: The Sandbox hit by major exploit as attackers mint 49B unbacked $SAND

The team isolated liquidity on BSC and Base, disabled bridging, and is preparing a compensation plan for affected LPs pic.twitter.com/zEktGZJbNG — crypto.news (@cryptodotnews) August 23, 2026

The fix, which binds the cache verification to both asset type and scriptPubKey, had been committed to the Elements master branch on Aug. 3 and merged on Sept. 2. But it had never appeared in a tagged release. The federation nodes were running version 23.3.3, dated April 13, which did not include the patch. Mononaut, the mempool.space developer, noted that federation functionaries accepted the exploit transactions, approved the withdrawals, and continued building blocks, while other nodes running different code rejected the invalid transactions entirely.

DeFi has lost more than $1.3 billion to hacks in 2026, with compromised private keys overtaking smart contract bugs as the leading attack vector for the first time on record. The Liquid exploit does not fit neatly into either category. No keys were stolen. No smart contract was drained. A caching optimization in transaction verification logic left a gap wide enough for someone to mint $320 million.

The 23 minutes that emptied the vault

The attacker was not reckless, and the on-chain record shows a methodical dry-run sequence that preceded the main event by two full days.

On Sept. 4, two small peg-in transactions totaling 2.15 BTC entered Liquid. Two days later, on the morning of Sept. 6, three dry-run peg-outs moved 0.95, 1.71, and 0.55 BTC through SideSwap between 11:30 and 13:16 UTC. Each one completed without issue. The peg-out mechanism worked. The federation signed. Real BTC arrived on the other side.

At 13:53 UTC, the main event: the minting transaction created roughly 4,000 unbacked L-BTC. At 14:28:56 UTC, the federation processed the peg-out, releasing 3,996.0183 BTC. SideSwap forwarded 3,995.99999857 BTC to the attacker’s final address in the same block. The SideSwap fee of 0.1%, roughly 3.996 BTC, plus the three dry-run payouts of 3.21 BTC combined, were the only friction in the entire operation.

From mint to peg-out to receipt, the elapsed time was approximately 35 minutes. From the moment the federation signed the peg-out to the moment the Bitcoin reached the attacker, it was a single block.

The reserve cliff is visible on any blockchain analytics dashboard. Liquid’s federation wallet held 4,205.29 BTC at 14:27 UTC. One minute later, it held 202.63 BTC. It is the most dramatic single-transaction reserve drain in the history of Bitcoin sidechains.

On-chain negotiation: nine messages in OP_RETURN

What happened next turned a catastrophic exploit into something closer to a hostage negotiation conducted entirely in public.

At 18:30 UTC on Sept. 6, roughly four hours after the drain, the attacker embedded a message in a Bitcoin transaction: “we are whitehats. contact us on chain.” The choice of communication channel was deliberate. OP_RETURN messages are permanent, public, and verifiable. Neither side can fake the origin of a message sent from an address they control.

Blockstream responded at 19:31 UTC with a straightforward request: “Please contact [email protected].” The attacker ignored the email offer.

At 03:30 UTC on Sept. 7, after Liquid had halted block production at 04:49 UTC, the attacker sent a longer message: “Please fix the bug first. The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix.”

This was not a ransom demand. It was a security disclosure with $320 million in collateral. The attacker wanted proof that the vulnerability was closed before returning funds that could theoretically be re-exploited by someone else.

JUST IN: Governance attack on Term Labs causes $8.5M loss

CertiK reported 2,843 ETH and $1.6M DAI concentrated at one address following the exploit pic.twitter.com/ujL8QtFok3 — crypto.news (@cryptodotnews) August 24, 2026

Blockstream spent the next several hours patching bridge nodes across the federation. At 09:04 UTC on Sept. 7, Blockstream sent a PGP-signed message: “Bridge nodes are patched, safe to return the funds.” The signature verified against the security key ending 6844 A2D6 published at blockstream.com/pgp.txt. Seven total verified Blockstream messages were sent from fresh addresses over the course of the negotiation.

At 16:09 UTC on Sept. 7, the return transaction landed: 3,400 BTC back to the federation address. The remaining 598.5 BTC stayed in the attacker’s wallet. The final OP_RETURN message from the attacker, sent at 21:03 UTC, contained a single emoticon: “:(“

That frowny face has become one of the most analyzed two characters in Bitcoin history. Was it regret at having to keep any amount at all? Disappointment that the bug existed in the first place? A sardonic comment on the state of sidechain security? Nobody knows, and the attacker has not communicated since.

The $47 million question: bounty or theft

The 598.5 BTC the attacker retained is worth approximately $47 million. There was no formal bug bounty program covering this vulnerability. There was no contract, no prior agreement, and no legal framework governing the situation.

Liquid’s attackers offered to return most of the 4,000 BTC, and they did. But “most” is doing heavy lifting in that sentence. Keeping 15% of a $320 million exploit without any prior agreement is not what most security researchers would call standard white-hat behavior.

Charles Guillemet, CTO of Ledger, was among the first prominent voices to push back on the white-hat framing. His argument was direct: genuine white hats disclose a flaw before moving hundreds of millions in collateral, not after. Draining 95% of a network’s reserves and then demanding a patch before returning anything resembles extortion more than it resembles security research.

The counterargument, and it is not a weak one, runs like this: the attacker found a live vulnerability that could have been exploited by a malicious actor at any time. By draining the funds and holding them, they prevented a black-hat from doing the same thing with no intention of returning anything. The 598.5 BTC is compensation for a service rendered, not a ransom paid under duress.