Attacker drains 4,000 Bitcoin from Liquid sidechain
- A caching bug in Elements software allowed an attacker to drain 4,000 Bitcoin from Liquid.
- The hacker returned 3,400 Bitcoin but kept 598.5 Bitcoin as an unnegotiated ransom.
- Federated multi-sig failed when all eleven signers ran the same unpatched software.
A caching shortcut just crippled Bitcoin's premier sidechain.
On Ungovernable Misfits, hosts q and a detailed how an attacker exploited the Elements software underlying Blockstream's Liquid Network. To reduce processing latency, the validation code cached confidential transaction range proofs. That cache failed to verify essential context like asset types or spending conditions. By feeding the protocol invalid proofs, the attacker generated fake Liquid Bitcoin that passed validation undetected.
The fake tokens were routed through automated exchange SideSwap, which accepted nearly 4,000 forged units and triggered a standard network peg-out. Liquid's security relies on an 11-of-15 federated multi-signature setup, but the multi-sig structure offered zero protection. Because all eleven signing nodes ran the same faulty Elements software, every node independently validated the forged assets, releasing roughly 3,996 real Bitcoin to the attacker and leaving barely 200 on the entire network.
The underlying code defect was not unknown. Independent analyst Orange Surf had submitted a pull request fixing the caching logic in early September, but the fix sat unmerged in the repository before the attack occurred. On Bitcoin And, host David Bennett noted that AI-powered vulnerability scanners have fundamentally compressed this window. Automated tools now continuously index open-source repositories, generating working exploits faster than human maintainers can merge security patches.
After Blockstream issued a critical emergency patch for bridge nodes, the attacker initiated on-chain communications. Using PGP-encrypted payloads and OP_RETURN messages, the hacker returned 3,400 Bitcoin to the network. However, they kept 598.5 Bitcoin - worth approximately $48 million - as a unilateral 15 percent finder's fee. When Blockstream attempted to negotiate the fee down via encrypted replies, the attacker terminated discussions with a single sad-face emoji and walked away.
The incident highlights growing tension across Bitcoin's security ecosystem regarding public disclosures. Hardware vendors are raising similar alarms about clout-driven vulnerability releases. Ledger CTO Charles Guillemette and Trezor security head Jan Komarek recently called for strict 90-day private disclosure windows, warning that premature public releases expose users to asymmetric risk while automated scanning tools make unpatched flaws instantly actionable for bad actors.
The Liquid drain exposes the core structural vulnerability of software-bound federations. When consensus logic itself contains a flaw, distributed hardware signers simply automate the mistake in unison.
Source Intelligence
- Deep dive into what was said in the episodes
4000 BITCOIN HACKED | THE BITCOIN BRIEF 89 • Sep 8
- An attacker drained nearly 4,000 Bitcoin from the Liquid Network after exploiting a software bug that accepted fake liquid Bitcoin as valid. Side swap accepted the coins, and the federation processed a peg-out of roughly 3,996 Bitcoin to the attacker.
- The Liquid federation's 11-of-15 multi-sig custody structure failed to stop the exploit because the underlying software validated the fake coins first. Since all signers ran the same faulty Elements code, they reached the same incorrect validation conclusion.
- The attacker communicated with Blockstream via on-chain OP_RETURN and PGP-encrypted messages, claiming they would return the funds once all nodes are patched. Max remains skeptical of a return, while q and a expects the attacker to comply.
Also discussed on this episode: (11)
Protocol (1)
- The Liquid exploit targeted a validation shortcut in the Elements software cache. The cache verified range proofs without validating asset types or spending conditions, allowing the attacker to bypass cryptographic checks with an invalid output that matched a cached description.
Coding (1)
- Orange Surf reports that the vulnerability was publicly exposed when a patch pull request sat open starting September 1. The attacker likely identified the unmerged bug fix and immediately exploited the live network.
Custody (4)
- Foundation released KeyOS 1.4 for Passport Prime, enabling app sideloading verified by developer certificates. The update allows custom security profiles, with plans for a whitelisted and vetted Foundation App Store to aid less technical users.
- Chilean exchange OrionX halted withdrawals after a forensic audit revealed $7 million in customer crypto was missing. Founding partners are accused of conducting unauthorized speculative trading with user funds without operating licenses between 2018 and 2021.
- The hacker responsible for the Wave 3 Coldcard exploit moved roughly 20.5 Bitcoin into Ethereum via Thorchain swaps. This constitutes slightly over 1 percent of the total 1,789 Bitcoin stolen during the exploit.
- Cake Wallet 6.4.4 added native Trezor support for cold storage, while Nunchuk added BitBox02 Bluetooth connectivity. Additionally, RoboSats Alpha 0.87 added three new coordinators and encrypted image uploads through Noster Blossom servers.
BTC Markets (1)
- CoinDesk reports that the Bitcoin-backed mortgage product offered by Better and Coinbase allows the lender to rehypothecate borrower collateral. This gives Better the right to reuse the pledged Bitcoin in secondary financial agreements, introducing additional counterparty risk.
Privacy (2)
- Trezor's shipping partner, ShipMonk, leaked customer records of approximately 67,000 US customers, bringing the total exposed to 80,000. The leak included names, physical addresses, phone numbers, and email addresses, highlighting shipping data risks.
- Pocket Bitcoin suffered a support system breach that exposed compliance records for 291 EU customers and bank transfer details for over 5,000 users. This breach directly links real-world identity data to public Bitcoin transaction histories.
Stablecoins (1)
- Two Thai businessmen are suing Tether for freezing $42.4 million in USDT across ten Ethereum addresses. The plaintiffs allege Tether executed the freeze based on an informal verbal request from Homeland Security, months before a warrant was issued.
Regulation (1)
- The US House canceled its late September voting sessions, narrowing the window to pass the Clarity Act before the midterm recess. A critical procedural vote requiring 60 votes to advance the regulatory bill is set for September 15.