Liquid Federation Reports Vulnerability Exploited to Release About 4,000 BTC

Liquid Federation has published an incident report detailing an exploit that resulted in the release of roughly 4,000 BTC from federation reserves. According to the report, the attacker leveraged a validation cache flaw affecting Elements' range proofs to create about 4,000 unbacked LBTC. The attacker then swapped the counterfeit LBTC for real BTC through SideSwap's authorized exit anchor pathway. Liquid's governing entities processed the transactions as valid and released approximately 4,000 BTC from reserves. Before the incident, Liquid held about 4,205 BTC. Prior to operations being suspended, reserves fell to a low of 197 BTC. The attacker, describing themselves as a white hat, has returned 3,400 BTC, leaving around 598.5 BTC outstanding. The report said no private keys were compromised, and the exit anchor mechanism operated as designed. Liquid remains offline. Blockstream is preparing an emergency release of Elements v23.3.4 and is working to restore the network with 1:1 BTC reserve backing.