Liquid Federation Reports Cache Vulnerability Led to Unauthorized L-BTC Minting

Liquid Federation said an attacker exploited a cache vulnerability in Elements range proof verification to mint about 4,000 unbacked L-BTC and redeem them for real BTC through an authorized SideSwap exit peg path. According to ChainCatcher, the Liquid functionaries treated the related transactions as valid and released about 4,000 BTC from the federation reserve. Before the incident, Liquid held about 4,205 BTC, and reserves fell to a low of 197 BTC before operations were paused. The self-described white hat attacker has since returned 3,400 BTC, while about 598.5 BTC remains unreturned. No private keys were exposed, and the exit peg mechanism itself operated as designed. Liquid remains offline, while Blockstream is preparing an emergency release of Elements v23.3.4 and working to restore the network with 1:1 Bitcoin reserve backing.