25 April 2018
Liquid Implosion · 6 September 2026
How a cache bug moved almost 4,000 BTC out of Liquid's reserve
Liquid's incident report says a cache flaw allowed about 4,000 L-BTC without matching BTC backing. The federation's Bitcoin transaction then paid 3,998.67 BTC across two peg-outs.
Liquid is a Bitcoin-linked network: its L-BTC is meant to match BTC held by its operators, the federation, one-for-one. A peg-out withdraws BTC by removing the matching L-BTC from circulation.
Transactions running · peg-outs disabled3,400 BTC returned · confirmed
Checked 20 September 2026, 23:41 CEST
01Status and guidance
Transactions are running. Peg-outs are not.
Checked 20 September 2026, 23:41 CEST. Availability depends on the service.
Read the network updateNetwork
Liquid says block production and transactions have operated normally since the restart. Some wallets and exchanges have reopened Liquid services, but each provider decides what is available. The two public explorers agree on the current chain.
Backing
SideSwap reported 4,229 L-BTC in circulation against 3,627 BTC in the federation reserve on 11 September. The difference was about 602 BTC. Peg-outs remain closed, so L-BTC cannot currently be redeemed for BTC through the federation.
Funds
A confirmed transaction returned 3,400 BTC. About 598.50 BTC remained at the reported address at the check above.
Peg-outs
There is still no reopening date. Liquid says peg-outs will return only after the reserve is fully backed and the required software updates, testing and independent security reviews are complete.
Software
Elements 23.3.4 is the latest signed release and hardens the proof caches. A software release does not by itself restore the peg.
02How the cache failed
How the cache confused different records
The four steps below use shorter example records to show the cache mistake: different fields become the same bytes once their boundaries are removed.
Illustration · 1 / 4
Normal peg
BTC in the federation wallet should match L-BTC in circulation.
When someone withdraws BTC, the matching L-BTC must first be removed from circulation.
BTC reserve
1 : 1
L-BTC
Eight squares stand in for the reserve and supply.
What happened on Liquid
The same 4,301 bytes were read as different fields.
Two transactions in block 4,050,335 contained a valid record that could prime affected caches. The mint transaction in the next block arranged different fields into the same byte sequence. Affected nodes could then reuse the earlier result instead of checking the invalid proof.
The federation payout transaction then paid two outputs totaling 3,998.67 BTC. The public record does not reveal the exact software and cached data on every server that signed the disputed chain.
03Timeline
Code history and incident events
The vulnerable code is public. The software version running on each federation server has not been published.
1 September 2026 · merged
PR #1592 restored the missing fields, but joined all four without recording their lengths. This is a source-code date, not a confirmed deployment date.
Merged change6 September 2026
Two valid records in block 4,050,335 could prime the cache. The next block reused the same bytes with different field boundaries, splitting the chain.
View block7 September 2026
Blockstream disabled the bridge nodes and paused Liquid.
Official status7 September 2026
A confirmed Bitcoin transaction sent 3,400 BTC to the published federation return address.
View transaction8 September 2026
Liquid published its incident report: about 4,000 unbacked L-BTC had reached the peg-out path.
Incident report9 September 2026
Elements 23.3.4 was released with hardened proof-cache keys.
Software release10 September 2026
Block production and transactions resumed. Peg-outs stayed disabled.
Network update11 September 2026
SideSwap reopened peg-ins, while warning that the public reserve remained below the L-BTC in circulation.
SideSwap update17 September 2026
Liquid said transactions had operated normally since the restart, but gave no date for restoring peg-outs.
Latest update04Sources
What the public record shows
The disputed transaction and Bitcoin payout are public, as is the relevant cache code. The exact software and cache contents on each Liquid server are not.
Sources and technical detailsOpenClose
Elements 23.3.4 remains the latest signed release. It records field lengths in both proof-cache keys, includes a previously missing surjection-proof input, and can bypass the range-proof cache.
Liquid says a full technical report will follow. That report was not on the Liquid account, the Blockstream blog or the Elements release and security pages when this page was checked.
Explorer snapshot at 20 September 2026, 23:41 CEST: Blockstream and liquid.network agreed on block 4,066,190 and its hash. Both APIs showed the disputed mint transaction as unconfirmed on the current chain.
An independent exact-transaction monitor still reported all 608 expected legitimate transactions from the abandoned fork on the accepted chain, and none of the eight tainted transactions. Its latest published check was 20 September at 19:29 UTC.
SideSwap says it found 70 balanced rehearsal transactions followed by the single unbalanced mint transaction. It also says its node ran a private security build supplied in August, yet still accepted the mint. These are SideSwap's findings; the build itself has not been published.
The demonstration hashes its bytes with the same fixed educational salt for both records. Full SHA-256 fingerprint:
Calculating…Incident and transactions
Liquid statementLiquid incident reportLiquid transaction-resumption updateLiquid ecosystem and peg-out updateBlockstream incident statusBlockstream restart updateBlockstream recovery positionBULL service updateSideSwap incident statementSideSwap peg-in updatePrimer transaction APrimer transaction BDisputed Liquid transactionBitcoin federation payoutSigned bridge-node message3,400 BTC return transactionReported withdrawal address
Source code
Protocol background and independent analysis
Blockstream now says it will not pay the requested ransom and will pursue legal and forensic recovery. That is Blockstream's position; the actors' identity remains unconfirmed.
A PGP-signed message placed on Bitcoin says the bridge nodes were patched. The signature does not identify its sender.
The incident report gives 15:53:10 UTC for block 4,050,336. The block explorer records 13:53:10 UTC, so this page uses the block height and does not treat either time as settled.