Liquid Network (Blockstream sidechain): Elements range-proof cache bug minted about 4,000 unbacked L-BTC

What happened

• 15:53:10 UTC 6 Sep 2026 (Liquid block 4,050,336): about 4,000 L-BTC not backed by reserves was created and pegged out through SideSwap’s peg-out authorization, releasing about 4,000 of roughly 4,205 BTC (about USD 320M).
• Root cause per the Liquid Federation: a flaw in how Elements nodes cache range-proof verifications. Independent analysis (Halborn) says the cache key omitted asset and script context, so a proof verified in one context validated a different issuance, and that a fix had reportedly been merged but was not in a tagged release. The Federation says no keys were compromised and the PAK mechanism worked as designed.
• Attribution: self-described white-hat actors, who negotiated publicly in OP_RETURN messages.
• Response: bridge nodes patched 01:09 UTC 7 Sep. 3,400 BTC returned 7 Sep. Elements v23.3.4 released 9 Sep. Blocks resumed 10 Sep. Peg-outs stay restricted until 1:1 backing is confirmed. About 598.5 to 600 BTC still outstanding.

Sources

• https://t.me/s/liquid/102
• https://www.halborn.com/blog/post/explained-the-liquid-network-hack-september-2026
• https://securityaffairs.com/?p=198697

This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.