Liquid Network suffers $320M hack as 4,000 BTC drained from federation wallet

Blockstream’s Liquid Network, one of the oldest and most prominent Bitcoin sidechains, lost approximately 4,000 BTC, worth roughly $320 million, after hackers exploited a bug in its underlying software on September 6. The federation’s reserves cratered from over 4,200 BTC to about 197 BTC in a single stroke, making it one of the largest security breaches involving a Bitcoin-adjacent network this year. The silver lining, if you can call it that: the attackers identified themselves as white-hat hackers and returned around 3,400 BTC after Blockstream confirmed it had patched the vulnerability. They kept approximately 598 BTC, valued at roughly $47 million, as a self-appointed bounty. How the exploit worked The vulnerability lived in the Elements software, the open-source codebase that powers the Liquid Network. Specifically, a range-proof verification cache bug allowed the attackers to create invalid Liquid Bitcoin (L-BTC) tokens that the system accepted as legitimate. Those fraudulent tokens were then processed through SideSwap’s Peg-out Authorization Key (PAK), which converted them into real BTC withdrawals from the federation wallet. Critically, no federation keys were compromised ...