Key Highlights
- SlowMist traced the September 6 exploit to a consensus-layer vulnerability in the Elements codebase.
- The attacker minted approximately 3,998.5 L-BTC without a corresponding peg-in and later redeemed the funds for BTC.
- The flaw stemmed from a range-proof cache key built from variable-length fields without length prefixes, allowing key collisions.
Security firm SlowMist has published an analysis of a consensus-layer vulnerability today that allowed an attacker to mint approximately 3,998.5 unbacked Liquid Bitcoin (L-BTC) on the Liquid Network on September 6, 2026. The firm traced the transactions and fund flows using its MistTrack tool.
Liquid is a federated Bitcoin sidechain built on Blockstream’s Elements software. The firm traced the transactions and fund flows using its MistTrack tool. SlowMist said MistTrack does not index Liquid, so the Liquid-side path was reconstructed from explorers.
According to SlowMist’s Sept. 11 analysis, at 13:52:10 UTC on September 6, two transactions with identical structure appeared in Liquid block 4,050,335. One minute later, a third transaction confirmed in block 4,050,336 introduced the 3,998.5 L-BTC into the UTXO set without any corresponding peg-in.
The assets were consolidated and spent within minutes, then redeemed for real Bitcoin on the Bitcoin mainnet through the federated peg-out channel. SideSwap said the peg-out used a valid Peg-out Authorization Key and that neither its systems nor that key were compromised. Blockstream said federation signing keys were not stolen. Both say the failure was in Elements validation.
Attack timeline and fund movements
The attacker address on Liquid is listed as ex1q7kgx4ptje7px48tn0nsmc6se5pngdp3smpqa2w. It conducted 91 transactions, with all 247 outputs fully spent. Five core transactions occurred on Liquid: two setup transactions, one minting transaction, and two consolidation or spending transactions. Additional peg-outs and payments took place on the Bitcoin mainnet.
The following day, 3,400 BTC was returned to the federated peg wallet. The remaining 598.5 BTC stayed under the attacker’s control, as per the report. At the time of the SlowMist report, the attacker continued to self-transfer the funds, embedding OP_RETURN messages in plain text that demanded a 10% bounty from the federation. The negotiation remains visible on-chain. Blockstream has said it will not pay a ransom and that withholding the coins is not white-hat disclosure.
The attack is classified as a pure consensus-layer, transaction-level incident with no affected smart contract. It involved a cache key collision in range-proof verification, also described as range-proof verification cache poisoning. All versions of the Elements codebase prior to 23.3.4 were affected, including builds released after an August 3 patch.
Technical root cause
According to SlowMist, the vulnerability originated in a performance optimization present in the Elements codebase since 2016. rangeproof is the check used in confidential transactions to show an amount is in a valid range without revealing the amount. The rangeproof cache key was formed by concatenating variable-length fields without length prefixes. Distinct argument tuples could therefore produce the same hash key.
In the attack sequence, two setup transactions first placed valid rangeproofs and commitments on-chain while embedding a crafted payload in the locking script to seed node caches. A subsequent minting output reused a colliding cache key—the same raw concatenation of proof, commitment, asset commitment, and scriptPubKey, but with different field boundaries. On a cache hit, nodes skipped the secp256k1_rangeproof_verify function and minimum-value checks, accepted an unbacked commitment, and minted the 3,998.5 L-BTC.
An August 3 patch added missing fields to the hash but did not address field boundaries. Those boundaries were exploited five weeks later. Elements version 23.3.4, released on September 8, added length prefixes to the cache key and introduced the -norangeproofcache emergency stop switch, which allows operators to reject all cached results and disable the cache entirely. The Liquid Federation said that release was reviewed internally and externally, including by the Bitcoin Red Team and Alpen Labs.
Network restart and current status
Blockstream and the Liquid Federation restarted block production on September 10, four days after the incident. An update posted at 12:26 UTC on September 10 confirmed a controlled restart. That post gave status as of 10:00 UTC the same day. Block production resumed without user transactions while the network was monitored. Functionary and bridge node updates were deployed, and functionaries resumed signing and validating blocks. Functionaries are federation members that sign Liquid blocks and control the Bitcoin reserve wallet.
Peg-in and peg-out operations, including those authorized through Peg-out Authorization Keys, remain suspended. The federation stated that restoration of the BTC/LBTC reserve is in progress. Blockstream Chief Executive Officer Adam Back has stated that the 1:1 LBTC-to-BTC peg will be covered. Back also told holders not to panic-sell L-BTC over the counter. He has not set a date for restoring peg operations.
SlowMist recommends that projects conduct comprehensive external security audits before deployment and that consensus-layer audit checklists include verification of cache-key integrity as a mandatory review item.
Still open: the 598.5 BTC still held by the attacker; when peg-in and peg-out resume; and how the reserve will be refilled to keep the 1:1 peg.
Also Read: Tether Assists DOJ in $52M Global Scam Enforcement
![trade[XYZ] Launches Event Contracts on Hyperliquid Using HIP-4](https://www.cryptotimes.io/wp-content/uploads/2026/09/TradeXYZ-Launches-Events-on-Hyperliquid-for-Prediction-Markets--615x410.jpg)