Liquid Network Breach: Rangeproof Cache Bug Enabled ~4,000 BTC Theft

On September 6, 2026, an attacker exploited a decade-old caching flaw in Elements, the open-source codebase behind Blockstream's Liquid sidechain, to mint roughly 4,000 unbacked LBTC in a single transaction. The bug traced back to a 2018 code change that stripped asset-commitment and scriptPubKey data from the rangeproof cache key, letting a previously verified proof be reused in a context where it should have failed — and functionary nodes accepted the forged transaction.

The attacker then peg-out the fake LBTC through SideSwap, a federation member holding peg-out authorization, draining Liquid's on-chain BTC reserve from about 4,205 BTC to 197 BTC. Blockstream halted public bridge nodes within hours, and after negotiations the attacker returned 3,400 BTC, leaving roughly 602 BTC unrecovered. A hardening release, Elements v23.3.4, shipped days later.

The incident is a cautionary tale for engineers building on federated or confidential-transaction chains: a subtle, non-security-flagged optimization from 2018 survived multiple audits and a 2019 refactor before becoming exploitable, showing how caching shortcuts around cryptographic verification can quietly erode consensus safety over long code lifetimes.