A self-proclaimed white hat operator is suspected of exploiting a vulnerability in Elements to generate approximately 4,000 abnormal L-BTC, which were then exchanged for 3,996 BTC through the normal redemption path of SideSwap, with no related keys found to have been leaked.

Written by: ChandlerZ, Foresight News

On September 6, at 22:05, a user sent 4,000 L-BTC to SideSwap's L-BTC redemption service. SideSwap destroyed this batch of L-BTC and submitted a valid exit authorization. Twenty-three minutes later, Liquid Federation paid 3,996.018 BTC from the Bitcoin mainnet wallet to the user's address, worth approximately $320 million.

About four hours after receiving the BTC, the funds controller wrote in a Bitcoin transaction, "we are whitehats. contact us on chain."

Currently, the centralized address related to the event still holds approximately 3,998.5 BTC, of which about 3,996 were from this large redemption, and there has been no return of funds. Blockstream is contacting the counterpart through on-chain signed messages, but their identity, motive, and return conditions have not been confirmed.

Liquid, developed mainly by Blockstream, launched in 2018, is a Bitcoin sidechain that uses the Federation mechanism. Users can lock BTC into a Federation wallet on the Bitcoin mainnet and receive an equivalent amount of L-BTC in Liquid for faster transfers, confidential transactions, and asset trading; when exiting, L-BTC needs to be destroyed, and then the Federation wallet pays the mainnet BTC. Liquid generates a block approximately every minute, and settlement usually completes with two confirmations, with the network block generation and mainnet BTC custody managed by a fixed group of Federation nodes.

After the incident, Liquid has been paused by the Federation, and external parties can no longer submit new transactions to the network. Exchanges have paused or are preparing to pause L-BTC deposits and withdrawals. The Bitcoin mainnet continues to operate as usual; however, wallet transfers, as well as SideSwap’s currency exchange, BTC deposits, and L-BTC withdrawals are all out of normal use.

How 4,000 L-BTC were exchanged for 3,996 BTC

SideSwap is a member of the Liquid Federation, providing users with conversions between L-BTC and BTC. Ordinary users cannot directly request BTC redemption from Liquid Federation but typically need to hand over L-BTC to a member holding a withdrawal authorization key (PAK), which then destroys the L-BTC and specifies a Bitcoin receiving address. SideSwap charges a 0.1% service fee for the redemption service, so 4,000 L-BTC corresponds to 3,996 BTC credited.

SideSwap stated that Blockstream later confirmed that this batch of L-BTC was abnormally generated by Elements software vulnerability. Elements is the node software used by Liquid, and SideSwap indicated that its service can only see L-BTC that has been validated through the Liquid network and cannot identify the differences between this batch of tokens and normal L-BTC. Liquid's initial announcement also confirmed that the funds were withdrawn by SideSwap's PAK, but this PAK, other authorized keys, and the SideSwap system have found no leakage.

Bitcoin Core contributor Antoine Poinsot discovered that Liquid block 4050336 was rejected by the mempool.space node but accepted by Blockstream's node. He later referred to this phenomenon as a consensus vulnerability. The transaction outputs in this block subsequently entered a large redemption processed by SideSwap, with two nodes providing different results for the same block, also explaining why external observers focused their investigation on Elements verification rules.

Liquid's confidential transaction technology defaults to hiding transfer amounts and asset types, with nodes relying on cryptographic commitments and range proofs to confirm input-output conservation and prevent the creation of assets out of thin air. Blockstream has not yet released an independent technical review, and the trigger method of the Elements vulnerability, the affected version, and the generation process of abnormal L-BTC have not been disclosed.

Multi-signature normal signature, abnormal assets passed upstream verification

Blockstream's official information shows that the Liquid Federation currently has over 80 members, of which 15 operate federation nodes. Each node holds a multi-signature key, and at least 11 nodes must sign for the federation wallet to pay BTC to the Bitcoin mainnet.

These nodes check two things during redemption: whether the corresponding amount of L-BTC has been destroyed on Liquid, and whether the receiving address has PAK authorization. The 4,000 L-BTC on September 6 had been destroyed, and the address provided by SideSwap also had valid authorization, leading to a subsequent payment completion with 11/15 multi-signature.

PAK is responsible for verifying the receiving address and cannot reassess how the L-BTC awaiting destruction was generated earlier. The 11/15 multi-signature can prevent a minority of nodes from independently using the federation wallet, but all 15 nodes still validate transactions according to the same Elements rules. Once an abnormal block is accepted by a majority of nodes, subsequent destruction and redemption will be shown as valid in the system; even if the federation private keys, hardware security modules, and PAK remain intact, the mainnet BTC could still be paid out.

Liquid also sets up time-locked emergency keys to retrieve locked funds when federation nodes stop working for a long time. The 3,996 BTC this time went through the normal 11/15 signature process, and the emergency key did not participate. Once the transaction is confirmed on the Bitcoin mainnet, Liquid cannot reverse the payment through a rollback of the sidechain.

The transferred BTC accounts for about 95% of Liquid's anchored reserves before the incident

Galaxy Research analysis indicates that the transferred BTC accounts for about 95% of Liquid's anchored reserves before the incident. On-chain records show that the federation wallet balance has dropped from approximately 4,200 BTC to about 197 BTC. If the funds cannot be recovered, Liquid will need to announce the redemption arrangements for existing L-BTC, as well as who will replenish the BTC in the federation wallet.

Liquid's quarterly report released on May 1 showed that the network processed a total of 1,163,100 transactions in the first quarter, compared to 233,700 in the same period last year; there were 14,063 BTC deposits totaling 1,252 BTC, as well as 1,201 L-BTC redemptions totaling 1,144 BTC, with BTC inflows exceeding redemptions by 108 BTC in the first quarter. This single redemption of 3,996.018 BTC amounts to about 3.2 times the total BTC inflow for the first quarter and is equivalent to about 3.5 times the total redemption amount during the same period.

DePix stablecoins accounted for about half of Liquid's transaction volume in the first quarter, while services like SideSwap and Boltz connected Liquid to the Bitcoin mainnet and the Lightning Network. Liquid stated that USDT, DePix, and real-world asset tokens have not been taken away by this vulnerability. However, during the closure of the bridging nodes, these assets are also unable to transfer or exchange normally.

In 2021, Liquid stopped block generation for about 22 hours due to inconsistent dynamic federation upgrade parameters, during which there were no fund losses. The 3,996 BTC has already been transferred on the Bitcoin mainnet, and reopening the bridging nodes will not reverse this payment.

As of September 7, Liquid and Blockstream have not disclosed the time for network restart, the technical report on the vulnerability, the fund return arrangements, or the L-BTC reserve replenishment plan. About 3,998.5 BTC remains at related addresses, and the white hat's statement by the funds controller has not been independently verified.