Blockstream faces 4,000 BTC Liquid network hack

TLDR

Blockstreams Liquid Network was exploited via a software bug that let attackers drain about 4,000 BTC, most of which has been returned but nearly 600 BTC remains missing.

1. Attackers minted roughly 3,998 L-BTC without backing and pegged them out for real BTC, draining about 95% of Liquids reserves before a patch was deployed.
2. About 3,400 BTC has been returned, but roughly 598.5 BTC, worth around $47 million, is still controlled by the attackers, while peg-outs on Liquid remain paused.
3. Blockstreams refusal to pay a whitehat ransom and the technical nature of the bug highlight ongoing security and governance risks around Bitcoin sidechains and bridges.

Deep Dive

1. Scale And Mechanism

On 6 Sep 2026, a vulnerability in Blockstreams Elements codebase allowed an attacker to mint approximately 3,998.5 unbacked L-BTC and redeem them for real BTC from the Liquid federation wallet, cutting reserves from over 4,200 BTC to about 197 BTC according to a detailed SlowMist analysis.

The flaw was a cache key collision in the range-proof verification process, which let different inputs share the same cache key and bypass proper checks on confidential transaction amounts. Importantly, Liquids federation signing keys were not stolen; the exploit abused logic in transaction validation rather than custody keys.

This makes the incident a protocol-level bug in the sidechain rather than a compromise of Bitcoin itself, but it still directly affected BTC held in Liquids reserves.

2. User Impact And Blockstreams Response

After Blockstream patched the software and shipped Elements v23.3.4, the attackers returned about 3,400 BTC, leaving 598.5 BTC unrecovered, valued near $47 million as reported by multiple outlets.

The attackers identified themselves as whitehats, used OP_RETURN messages on Bitcoin to negotiate, and demanded a 10% bounty. Blockstream publicly rejected this, stating that draining funds then withholding their return is theft rather than responsible disclosure and that it will not pay a ransom.

Liquid has resumed block production and transactions, but peg-outs remain disabled and L-BTC is only around 85% backed while the missing BTC is unresolved, according to Blockstreams recovery updates summarized in post-incident reports.

3. Lessons And Whats Next

The episode has sparked controversy over whether the bug was properly disclosed. The volunteer Bitcoin Red Team says it warned Blockstream about the issue before the exploit, while Blockstream executives deny ignoring emails and attribute the failure to a flawed AI-assisted bug fix, as covered in security commentary.

For Bitcoin users, the key takeaway is that sidechains and bridges add complex software attack surfaces, even when core BTC custody keys remain intact. Range-proof caching and performance optimizations can introduce subtle bugs with large financial impact.

Next, watch for Blockstreams full postmortem, any legal or law-enforcement actions to trace the remaining BTC, and whether third parties step in to recapitalize Liquid so L-BTC regains full backing.

Confidence: high because multiple independent technical and news reports describe consistent timelines, amounts, and root cause.

Conclusion

Blockstreams Liquid Network exploit shows that even mature Bitcoin infrastructure can suffer large losses when sidechain logic breaks, despite the main chain remaining secure. Most reserves have been recovered, but peg-out restrictions and unrecovered BTC keep risk elevated for Liquid users. How Blockstream and the wider ecosystem handle disclosure, recovery, and the refusal to pay ransom will shape norms for future bridge and sidechain incidents.