Liquid Network drained of $320 million as cache bug lets attacker mint unbacked Bitcoin

A range-proof cache bug in the Elements codebase let an unknown actor mint unbacked L-BTC, drain 95% of the federation reserve through SideSwap, then negotiate its return on-chain via OP_RETURN messages. The network remains frozen, 598.5 BTC sits in the attacker’s wallet, and the entire federated sidechain model faces the hardest questions it has ever had to answer. Summary An unknown actor exploited a range-proof verification cache bug in Elements to create roughly 4,000 unbacked L-BTC and peg them out for real Bitcoin on Sept. 6, 2026, draining 95% of Liquid’s reserves in 23 minutes. The attacker communicated via Bitcoin OP_RETURN messages, declaring “we are whitehats,” and returned 3,400 BTC after Blockstream patched its bridge nodes, while keeping 598.5 BTC (about $47 million) as a self-declared bounty. Blockstream confirmed no federation keys were compromised, attributing the exploit to a cache-key collision in the confidential transactions verification logic that had entered the Elements master branch but never appeared in a tagged release. The Liquid Network halted block production at 04:49 UTC on Sept. 7, exchanges suspended L-BTC deposits and withdrawals, and the network remains frozen as of this writing. The incident has reignited debate over federated sidechain trust models, drawing comparisons to the 2016 Ethereum DAO hack and raising legal questions about whether keeping $47 million without a formal bounty agreement constitutes theft or legitimate security research. Sunday afternoons are not supposed to feel like bank runs. Yet on Sept. 6, 2026, anyone watching the Liquid Network federation wallet saw something that looked a lot like one: 3,996 BTC leaving in a single peg-out transaction at 14:28 UTC, collapsing the reserve from 4,205 BTC to 202 BTC in less than half a minute. At prevailing prices, that was roughly $320 million. Gone. What followed over the next 30 hours was one of the strangest episodes in Bitcoin’s history. The person or group behind the drain did not disappear into a mixing service. They wrote “we are whitehats. contact us on chain” in an OP_RETURN field, opening a public negotiation with Blockstream that anyone with a block explorer could read in real time. Nine messages went back and forth. A PGP key was verified. Bridge nodes were patched. And then 3,400 BTC came back, leaving 598.5 BTC, about $47 million, sitting in an address that nobody controls except the attacker. The mechanics of what happened are technical. The implications are not. Liquid is the oldest Bitcoin sidechain, operated by a federation of 15 functionaries running tamper-proof hardware security modules in an 11-of-15 multisig arrangement. It has processed billions in volume for exchanges, traders, and tokenized asset issuers since its launch in 2018.