Deep Analysis: The Liquid Network Rangeproof Cache Collision — A Full-Chain Review
This is a full-chain review of the September 6, 2026 Liquid Network exploit — 3,998.5 unbacked L-BTC minted and pegged out (~$320M at ~$80K/BTC), roughly 3,400 BTC (~$272M) returned after the patch, and ~598.5 BTC (~$48M) still under negotiation — reconstructed from SlowMist's September 11 analysis, federation statements and on-chain records. The eight steps follow this desk's standard framework.
By colliding Elements' rangeproof verification cache. Cache keys were built by concatenating variable-length fields without length prefixes, so two different inputs could produce the same key. Crafted setup transactions seeded node caches with a legitimate proof's verdict; a subsequent transaction reused the same raw key concatenation with different field boundaries, inheriting the cached 'verification passed' result and minting 3,998.5 unbacked L-BTC.
- Minted unbacked3,998.5 L-BTC~$320M at ~$80K/BTC
- Reserve drain~95%from ~4,200 BTC to ~197 BTC
- Returned~3,400 BTC~$272M, after the patch
- Outstanding~598.5 BTC~$48M, negotiation ongoing
1. What Happened
On September 6, 2026 at 13:52 UTC, two identically structured transactions landed in Liquid block 4,050,335. A minute later a third transaction introduced 3,998.5 L-BTC into the UTXO set with no corresponding peg-in. The attacker consolidated and spent within minutes, then redeemed the tokens for real Bitcoin on the main chain through the federated peg-out channel. The federation reserve fell from ~4,200 BTC to ~197 BTC — roughly 95% of reserves — before operations were suspended.
2. The Architecture
Liquid is a federated Bitcoin sidechain built on Blockstream's Elements software. Its confidential transactions hide amounts using rangeproofs — cryptographic proofs that amounts fall within valid ranges. Because rangeproof verification is computationally expensive, Elements caches previously verified proofs: on a cache hit, the node skips secp256k1_rangeproof_verify and the minimum-amount check entirely. The optimization has been in the codebase since 2016.
3. The Flaw: Cache Keys Without Length Prefixes
Before v23.3.4, cache keys were generated by concatenating variable-length fields — proof, commitment, asset commitment, scriptPubKey — without length prefixes. Concatenation without boundaries is ambiguous: two different tuples of values can produce the identical byte string and therefore the identical hash key. On a collision, the node treats the new proof as already verified because its key matches a legitimate one's cached verdict.
4. The Attack, Step by Step
The attacker's sequence had three moves. First, two setup transactions placed valid rangeproofs and commitments on-chain while embedding a crafted payload in the locking script to seed node caches. Second, the minting transaction reused the colliding key — the same raw concatenation with different field boundaries — so nodes accepted an unbacked commitment as verified. Third, rapid consolidation, spending and peg-out converted the unbacked L-BTC into mainchain BTC within minutes. Notably, an August 3 patch had added missing fields to the cache hash but not addressed field boundaries; the fix that mattered, v23.3.4 with proper length prefixes, shipped only after the incident.
5. Why the Federation Held
Every federation key was sound: SideSwap's peg-out used a valid Peg-out Authorization Key, and Blockstream confirmed no signing keys were compromised. The failure was entirely in validation software — a federation is only as strong as the code that decides what its keys are allowed to authorize. The attack is classed as pure consensus-layer, transaction-level; no smart contract was involved.
6. Response and Recovery
Peg operations were suspended and block production paused; public bridge nodes were disabled. Elements v23.3.4 patched cache-key management with proper length prefixes, and the network restarted September 10 — four days offline. The attacker, communicating via Bitcoin OP_RETURN messages, described themselves as a white-hat researcher demanding a 10% bounty. After the patch, roughly 3,400 BTC (~$272M) returned to the peg wallet; ~598.5 BTC (~$48M, about 15%) remained attacker-held, self-transferred with on-chain messages. Blockstream stated it will not pay a ransom and that withholding coins is not white-hat disclosure.
7. The Money Trail
SlowMist's MistTrack-based analysis reconstructed the Liquid-side path from explorers (MistTrack does not index Liquid) and traced the Bitcoin-side flows: the attacker address conducted 91 transactions with all 247 outputs fully spent, five core transactions on Liquid (two setup, one mint, two consolidation/spend), with peg-outs and payments on the main chain. The returned ~3,400 BTC went directly to the federation peg wallet; the retained balance moved through self-transfers with embedded OP_RETURN messages.
8. The Lesson
Cache keys are trust boundaries. Anywhere a system caches a verdict — proof verification, signature checks, validation results — the key must be collision-proof under adversarial input, and 'already verified' must mean the same input, not the same bytes. The general audit is cheap and urgent: enumerate every cached-verdict pattern in your stack, check key construction for unambiguous encoding, and treat performance optimizations as security-relevant code. Liquid's second lesson is response design: the peg suspension converted an open-ended drain into a bounded event, and the on-chain negotiation returned most of the haul — ugly, effective, and now part of the record.
Sources
- SlowMist, 'Liquid Network cache key collision' incident analysis (September 11); MistTrack tracing.
- CoinDesk, SlowMist analysis coverage and damage figures.
- The Block, Liquid Network pause and restart coverage.
- Liquid Federation incident notice; SideSwap statement on the Peg-out Authorization Key.
- BingX / Odaily flash coverage of SlowMist's findings (return and bounty figures).
This article is for general information only. It describes publicly reported security incidents; dollar figures are point-in-time estimates drawn from the sources listed above and may be revised as investigations continue. Nothing here is financial, legal or investment advice.
Frequently Asked Questions
Were the Liquid federation's keys compromised?
No. Blockstream and SideSwap both confirmed the federation signing keys and the SideSwap Peg-out Authorization Key were not compromised. The failure was in Elements' rangeproof verification cache — the software that decides what the keys may validly authorize.
Why is the total reported as both $320M and $48M?
$320M is the gross: 3,998.5 L-BTC minted unbacked and pegged out at ~$80K per BTC. ~$48M is the net: the roughly 598.5 BTC the attacker retained after returning ~3,400 BTC (~$272M) post-patch. This desk reports both, with the net figure used for week-over-week comparisons.
What should projects audit after this incident?
Every cached-verdict pattern: proof verification caches, signature caches, validation-result caches. Check that cache keys are built with unambiguous, length-prefixed encoding of all inputs, and test that distinct inputs can never collide. Elements versions prior to v23.3.4 are affected.
Was this a Bitcoin problem?
No. Bitcoin mainchain was never at risk. Liquid is a federated sidechain built on Elements; the flaw and the funds were both on the sidechain and its peg.
Strengthening your defenses? See how transaction fees and energy costs scale on Tron at Tronsell.io.