Overview
- A flaw in Elements’ range‑proof verification cache let an actor create unbacked L‑BTC and use SideSwap to withdraw about 3,996–4,000 BTC from the Liquid federation, and Blockstream says federation signing keys were not stolen.
- Emergency fixes were released as Elements v23.3.4 to harden cache keys used in range‑proof validation, and functionary and bridge nodes were updated before any block production resumed.
- Block production has restarted in a controlled mode without adding transactions while peg‑ins and peg‑outs remain suspended to monitor stability and restore reserves.
- After operators confirmed patches, the attackers returned roughly 3,400 BTC but left about 598.5 BTC in their address and publicly demanded a 10% payout, a demand Blockstream has rejected and labeled theft.
- SideSwap acknowledged that keeping its peg‑out authorization key online and processing same‑block automatic payouts with no size or origin checks turned the software bug into a main‑chain loss, leaving L‑BTC roughly 85% backed and holders unable to redeem normally.