4,000 BTC out of thin air: the Liquid exploit and the boundary between sidechain and Bitcoin
On 6 September 2026 an attacker created around 4,000 unbacked L-BTC on the Liquid Network and redeemed them as real bitcoin through the regular peg-out. What the case teaches about chain boundaries and why the trail on the Bitcoin side starts at the federation.
Sidechains promise the best of both worlds: fast, confidential transactions on a chain of their own, backed by real bitcoin held in reserve. Blockstream's Liquid Network is the oldest and largest of these sidechains. On 6 September 2026 that very construction became the point of entry.
The sequence of events
At 15:53 UTC, in Liquid block 4,050,336, an attacker exploited a vulnerability in Elements, the open-source software that Liquid nodes run. Liquid uses Confidential Transactions: amounts are encrypted, and a so-called range proof demonstrates that no money is created out of nothing. Nodes store verified range proofs in a cache. The key of that cache was encoded ambiguously, so two different verification inputs could point to the same cache entry.
The attacker primed the cache with valid setup transactions and then submitted a transaction whose invalid proof was treated as already verified. The result: around 4,000 L-BTC with no bitcoin behind them in the reserve.
The second step is the remarkable one. The unbacked L-BTC were not sold through some detour but redeemed via the regular peg-out. Liquid only permits withdrawals to addresses that a federation member has approved with a peg-out authorisation key. The attacker used the SideSwap service, one such federation member. The federation's functionaries processed the withdrawal as authorised, around 4,000 BTC left the peg wallet to SideSwap's whitelisted address, and from there to the address specified by the attacker.
On 7 September at 16:09 UTC the attacker returned 3,400 BTC to the federation's peg wallet. About 598 BTC, roughly 15 percent, remained outstanding. Blockstream temporarily halted block production and published an emergency release of Elements.
Why the case is instructive for forensics
The chain boundary is an evidence boundary. Nothing of the exploit is visible on the Bitcoin blockchain. There is only a large, formally correct withdrawal from the Liquid peg wallet to a federation address and onwards. Anyone looking at Bitcoin alone takes this transaction for an ordinary peg-out. Only the Liquid side reveals that the redeemed L-BTC were never backed.
Peg-in and peg-out are vault transitions. Methodologically this is the same problem for us as THORChain or Chainflip: there are known, public addresses where value changes chains, and there is a temporal correlation between an inflow on one side and an outflow on the other. We therefore maintain the Liquid federation's peg wallet, the peg-out address of the federation member involved and the attacker's address as separate entities. A withdrawal from the peg wallet is neutral at first, since the overwhelming majority of peg-outs are legitimate. Only the link to a specific Liquid event determines whether a withdrawal is proceeds of an exploit.
The return splits the trail in two. The 3,400 BTC returned are forensically closed. The 598 BTC outstanding are the part that remains under observation. For exchanges it is crucial that the attacker cluster flag is not applied to the entire original withdrawal, but only to the outputs that remained after the return. Otherwise the federation itself, which got its money back, becomes a hit.
What remains
The Liquid exploit was not an attack on Bitcoin, but on the promise that a sidechain never overdraws its reserve. For investigators the lesson is the same as in every cross-chain case: the trail does not vanish at the chain boundary, it merely changes data source. How we detect vault transitions and rate them with confidence is described using THORChain as an example here.