Liquid Network recovers 3,400 BTC after exploit; bug traced to Elements cache validation flaw

Liquid Network has published a post-incident report detailing a security event that occurred on September 6, when an attacker exploited a vulnerability in Elements, the network's underlying open-source software. According to the report, the exploit enabled the minting of roughly 4,000 LBTC without corresponding BTC reserves, an amount valued at about $320 million. The illicitly created LBTC was then swapped into BTC and withdrawn via SideSwap, driving Liquid's reserves down from about 4,205 BTC to 197 BTC. Liquid said the root cause was a cache validation issue in Elements rather than a private key compromise. Other assets on the network, including USDT, were not affected. Blockstream deployed a patch to the crosschain nodes on September 7. While the vulnerability has been addressed, the network remains paused. The attacker has described themselves as a white-hat security researcher. Liquid said 3,400 BTC (around $272 million) has been returned to the pegged wallet, while about 598.5 BTC (roughly $47.88 million) remains outstanding. Blockstream said it is negotiating with the parties involved. Blockstream expects to release an emergency Elements update, v23.3.4, within 48 hours and begin the recovery process. On September 7, it had previously reported that the attacker withdrew approximately 4,000 bitcoins from the Liquid Federation wallet.