Liquid Network Recovers 3,400 BTC After Elements Exploit; Remains Paused
On September 6, 2026, a range-proof caching vulnerability in open-source Elements was exploited to create unbacked L-BTC and redeem it for real bitcoin through SideSwap, reducing Liquid’s federation reserve from 4,205 BTC to 197 BTC. On September 7, the exploit group returned 3,400 BTC, but approximately 598.5 BTC reportedly remained with them; Blockstream patched the issue, and the Liquid Network remained paused for an emergency update.
The core incident is explicitly supported by Liquid’s incident report: an Elements range-proof caching vulnerability was exploited on September 6, 2026, creating unbacked L-BTC and enabling approximately 4,000 BTC of real reserves to be withdrawn. The incremental development is the September 7 return of 3,400 BTC, while approximately 598.5 BTC reportedly remained with the exploit group and the network stayed paused for remediation. This is a material, forward-looking cybersecurity and operational-risk event, although its direct scope is narrower than a systemwide crypto-market event. The timestamp uses the explicitly stated September 7 return date with midnight UTC as a date-only estimate. AON and MMC are the only approved stakeholders because the input provides a clear insurance and risk-advisory demand channel; more speculative cybersecurity, custody, compliance, and trading beneficiaries are excluded.
The hackers exploited a bug in the open-source Elements software to create unbacked L-BTC tokens, which they swapped for real bitcoin via SideSwap’s peg-out service, dropping the federation’s reserve from 4,205 BTC to 197 BTC.
Blockstream patched the range-proof caching issue, and the group returned 3,400 BTC on September 7, holding onto about 598.5 BTC amid talks for a 10% bounty from company funds.
The network stays paused for an emergency update, with CEO Adam Back promising a resumption plan; community views split between praising the recovery and calling the demand extortion.