Liquid Network (Blockstream) exploit on 2026-09-06
Exploit on Bitcoin, 6 Sep 2026. Last verified 4 Nov 2026.
critical
Reported loss
Not in USD
see the amount as stated below
Recovered
Not in USD
3,400 BTC returned; approximately 602 BTC outstanding
Status
Partially recovered
updated 26 Oct 2026
Date
Bitcoin, other
Summary
On 2026-09-06 an attacker exploited a consensus bug in the rangeproof verification cache of Elements, the software behind the Liquid sidechain, to create unbacked L-BTC and peg out approximately 4,000 BTC through SideSwap. The attacker returned 3,400 BTC the next day, while about 602 BTC remained outstanding.
- Protocol
- Liquid Network (Blockstream)
- Type
- Exploit
- Reported loss
- approximately 4,000 BTC
- Recovered
- 3,400 BTC returned; approximately 602 BTC outstanding
Facts and where they come from
| Fact | Value | Source |
|---|---|---|
| Date | September 6, 2026 | blog.blockstream.com ↗ |
| Amount | approximately 4,000 BTC | blog.blockstream.com ↗ |
| Recovered | 3,400 BTC returned; approximately 602 BTC outstanding | blog.blockstream.com ↗ |
| Transaction | 8db751a650ae2f12006b7e8c69a75e4df360e8afd6b9e05ae0b9fa6458a7b140 | sideswap.io ↗ |
On-chain transactions
- BitcoinTransaction 8db751…b140
Primary sources
- Blockstream: Liquid Network security incident assessment ↗ post-mortem · accessed 2026-11-04
- SideSwap: statement on the Liquid Network incident ↗ official announcement · accessed 2026-11-04
Our own summary of facts published by the sources above. We do not attribute fault beyond them. Amounts are as the sources state them (no USD conversion by us); links and quoted figures last checked 2026-11-04.
Get the next one first
- Alert on new security incidents: hacks, depegs, TVL drops and exchange outflows, by e-mail or Telegram