Liquid Network Bleeds 4,000 BTC via an Elements Bug
Attackers minted 4,000 unbacked L-BTC and cashed out $320M in real Bitcoin. Blockstream halted the Liquid sidechain, while Bitcoin's base layer stayed safe.
The keys held; the code didn't
Blockstream's Liquid Network has lost almost its entire bitcoin reserve. On 6 September, attackers moved about 4,000 of the 4,200 BTC held in the sidechain's federation wallet, roughly $320 million at prices near $80,000. Blockstream says no private key was compromised. The culprit was a software bug in Elements, the codebase that runs Liquid.
That distinction matters. Rather than stealing existing coins, the attackers exploited a consensus flaw to mint more than 4,000 L-BTC that were never backed by real bitcoin. They routed the synthetic tokens through the whitelisted SideSwap venue and redeemed them for genuine on-chain coins at the federation's peg-out. Bitcoin's base layer was untouched throughout: the failure lived entirely in the sidechain protocol.
A hacker at the negotiating table
The stranger half is what came next. The attackers present themselves as white hats and have offered to return most of the coins once the vulnerability is patched. The pledge is unverified, and a party sitting on $320 million negotiates from a position of strength. Blockstream is tracing the addresses and publicly rates recovery as possible.
For now, containment is the story traders care about. Blockstream said USDT and other Liquid assets were unaffected, and exchanges suspended L-BTC deposits and withdrawals. The damage stays inside the sidechain perimeter. But it dents the core pitch: Liquid's eleven-member federation was sold as the conservative, permissioned answer to leaky open bridges. The supposedly hardened design is exactly what broke.
The risk sits in the model, not the math
The episode joins a costly run of bridge and sidechain exploits. In August a Sandbox exploit conjured billions in synthetic SAND from nothing; before that, Coldcard users were drained. The pattern holds: Bitcoin's cryptography keeps working, and the layer bolted on top for speed and liquidity keeps cracking.
The trade takeaway is sober. L-BTC will change hands at a trust discount until the peg is proven whole, and the premium on native custody rises with every headline like this. Spot bitcoin should barely flinch while the $320 million stays trapped on the sidechain. Should the white-hat promise curdle into a real outflow, a technical incident turns fast into a credibility problem for the entire federated-peg model.