Liquid Network: Incident Report

On September 6th, an attacker exploited a software bug in Blockstream's Liquid Network to mint ~3,996 L-BTC that was unbacked, then redeemed it through a federation member for real bitcoin. The attacker drained roughly $319 million from the federation's reserve.

No private keys were compromised; a flaw in transaction verification let a counterfeit transaction pass. The fix had been publicly available since August 3rd but had not been published onchain. The self-described white-hat returned 3,400 BTC (~$268M) the next day and still holds 598.5 BTC (~$48M) as negotiations continue for the return of funds. The network has since been restored; no user losses have been announced to date.

How the Attack Unfolded

Liquid is a federated Bitcoin sidechain that was launched by Blockstream in 2018. When Bitcoin ("BTC") is bridged to Liquid Network, a “peg-in”  transaction locks BTC in a multisig reserve controlled by the federation and issues an equal amount of L-BTC on the Liquid Network. When L-BTC is bridged out, a “peg-out” burns the L-BTC token and releases the BTC on the Bitcoin network. That two-way peg process is how users bridge tokens in and out from the network through a gated bridge, since only federation members holding a peg-out authorization key can redeem funds to whitelisted Bitcoin addresses. Ordinary holders go through member services such as SideSwap, which peg out on their behalf. Before the incident, the peg-out reserve held about 4,205 BTC.

Liquid transactions are confidential, so each one carries a proof showing the hidden amount is legitimate. Checking those proofs is slow, so Elements caches the result once a proof has passed. The attacker exploited a bug in how cache entries were labeled. The label was built from only part of what makes a proof valid, leaving out two details a full check examines: which asset the transaction involves and where the funds are going. That meant two different transactions could share one label.

The attacker got a legitimate transaction checked and cached, then submitted a doctored one reusing the same proof. Nodes found the stored "pass" and accepted the doctored transaction without ever fully checking it, creating ~4,000 L-BTC backed by no BTC in the federation’s reserve. The chain split at that block. The few nodes running the patched code (at the time only a repository commit, not a shipped release) rejected it, while nodes on the standard release, including the federation's own, accepted it.

How Blockstream Responded

Blockstream disabled the bridge nodes and paused the network. Exchanges froze L-BTC deposits and withdrawals. Other Liquid assets, including USDT, run on the same infrastructure and weren't touched. 

Shortly after the exploit, the attacker sent transactions with short text notes to the federation's wallet, saying "Please fix the bug first. The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix."

Blockstream patched its bridge on September 7th. Their fix added the missing information so no two transactions can share the same label. Later that day, 3,400 BTC was sent back to the federation's wallet. On September 9th, the network restarted from its pre-exploit state, with the exploit and peg-out erased from its history and the invalid redemption rejected.

Holders are still in a state of uncertainty while L-BTC balances on the sidechain are intact but the reserve behind them is missing 598.5 BTC. Blockstream said the network resumed "with 1:1 backing for BTC," which implies the federation will make up the deficit themselves. 

No end-user loss has been realized to date. SideSwap only kept a 0.0183 BTC service margin, and the negotiations with the attacker over the remaining BTC are ongoing.

Does Nexus Mutual Cover This?

Nexus Mutual was not covering Liquid Network at the time of the incident. None of our members had requested cover for the Bitcoin sidechain, and we had not been contacted by Blocksteam to discuss coverage for their bridge or end users. However, we are in conversation with multiple Bitcoin sidechains and DeFi protocols as part of our expansion across the non-EVM space, helping bolster user confidence with the same industry-leading coverage we’ve made available on Ethereum since 2019.

This exploit was caused by a vulnerability in the underlying code that allowed the attacker to mint unbacked L-BTC and withdraw from the bridge.

Nexus Mutual covers these types of loss events with Native Protocol Cover and Protocol Cover for select bridges, such as the Hyperliquid Core bridge. Both cover wordings name a loss of funds due to "a smart contract code bug or error resulting in the Designated Protocol being used in an unintended way" as a covered event. A code vulnerability that allows an attacker to mint unbacked tokens and redeem them for BTC is clearly not the intended use of the Liquid Network bridge.

A Month in Plain Sight

The one caveat in this situation is the gap between the fix becoming public and the attack. Elements’ code is reviewed the way Bitcoin Core is, by the developers who maintain it rather than through external audits. A fix for the bug was committed to the public Elements repository on August 3rd, but with no formal disclosure and no new release. The patch sat visible in the open-source code for 34 days while the federation's nodes kept running the latest official release, which didn't include it.

Anyone reading the commit could work out the vulnerability, and the attack came before the fixed release shipped. For a claim to be valid, the cover would have to have been purchased before the vulnerability was made public.

Nexus Mutual has covered over $7 billion since 2019, and this is the kind of risk our record was built on: a bug in the code, a protocol used in a way nobody intended, and an onchain loss. If you operate a network or a bridge and want to know how Native Protocol Cover would work for you, reach out at nexusmutual.io/contact.

You’re Covered with Nexus Mutual