← The Polylog Crypto Intelligence Brief
Morning Edition · Wednesday, October 21, 2026Published at 1:37 AM EDT · New York
Liquid Network Enters Final Recovery Stage a Month After Consensus Bug Drained 4,000 Bitcoin
Attackers who say they are white hats returned about 3,400 BTC and kept roughly 598 BTC, so Blockstream's sidechain is still short of full one-to-one backing as swaps resume in phases.
The Liquid Network, the Bitcoin sidechain built by Blockstream and used by exchanges and trading desks, says it is running again and in the final stages of recovery. Attackers took about 4,000 BTC from its federation wallet in September. Swaps between bitcoin and Liquid bitcoin (L-BTC) have resumed in phases while the operators work to restore full one-to-one backing.
The attack started with an inflation bug in Elements, the open-source codebase Liquid runs on. According to Blockstream's incident assessment and outside analyses, a verification cache did not record the asset and script context of proofs it had already checked. The attackers reused a proof that had been verified in one context to validate a new, unauthorized issuance. They minted about 4,000 L-BTC that had no backing and then redeemed it for real bitcoin through the federation's peg-out process, which sends bitcoin back to the main chain. Blockstream says no signing keys were compromised. Under the faulty consensus rules the withdrawal looked valid, so the federation's signing servers approved it.
The attackers then negotiated in public. They wrote messages into Bitcoin transactions and told Blockstream to fix the bug and patch every node before they returned anything. Blockstream answered with a signed on-chain message saying the bridge nodes were patched. The group returned about 3,400 BTC and kept about 598 BTC, roughly 15% of the total, as a bounty it set for itself. The theft was worth about $320 million at the time.
The shortfall is the open question for L-BTC holders. A wrapped bitcoin is worth only what its custodian can redeem. Until the missing 598 BTC is covered, L-BTC is backed by less than one bitcoin per token.
Veracity: Corroborated
84/100- If true, who benefits
Part of a tracked trend
Losses Move to Components That Worked as Designed
A growing share of DeFi losses will come not from buggy contract code but from components behaving exactly as specified — oracle forwarders, validator signature sets, governance votes and other trusted off-contract inputs — so audits and bug bounties scoped to on-chain code keep missing the failure surface, and protocols will be repeatedly forced to extend review, scope and monitoring to their privileged operational infrastructure.
Townsquare
Start a discussion in Townsquare.
More from this edition
- Solana Switches to Alpenglow Consensus Today, Targeting 150-Millisecond Finality
- Aztec Says Proving-System Flaw Leaves Alpha V5 Funds Exposed Until V6
- Eight eMudhra Certificate Keys Were Tiny Numbers Such as 4, and Browsers Blocked Them
- Zcash Sets November 5 for NU7 Upgrade With 25-Second Blocks, and ZEC Rises 11%
- Drift Exploiter Moves About $63 Million of Ether Into Tornado Cash After Two Months Idle
- SEC Keeps Taking Comments on Regulation Crypto After Ripple Backs the Rule and Asks for an Issuer-Promise Test
- Qubic Restarts Its Chain After Weak Apple-Device Wallet Seeds Let an Attacker Drain $1.4 Million
Comments
1Oct 21, 5:37 AM
The roughly 598 BTC the attackers kept is about 15 percent of the 4,000 BTC drained, so full backing for L BTC depends on that amount being returned or covered from another source.