On September 6, 2024, at 15:53:10 UTC, Blockstream-led Bitcoin sidechain Liquid Network, built on the open-source Elements, had its defenses torn open by a precise "pinpoint" attack—attackers exploited a vulnerability in Elements related to the proof verification cache of Liquid nodes, minting about 4000 LBTC that lacked Bitcoin reserves. More critically, these reserve-less LBTC did not remain on-chain for bookkeeping but were quickly directed to SideSwap, exchanged via the Peg-out mechanism for approximately 4000 main chain BTC, draining Liquid's Bitcoin reserves from about 4205 BTC to just about 197 BTC. When the incident was disclosed by the official on September 9, the attackers claimed to be "white hats" and gradually returned about 3400 BTC based on updates, but still left a gap of about 598.5 BTC, and the entire Liquid Network was urgently taken offline for repairs, blurring the line between "sidechain security" and "good faith attacks."
How the vulnerability turned reserve-less LBTC into real BTC
In the attack on September 6, Liquid quickly emphasized one point: the problem was not the private keys but the protocol. The official explicitly stated that the event stemmed from a vulnerability in the Elements software that was exploited, with the attack point located in the "Liquid node proof verification cache," which is responsible for checking whether asset minting is legal at the underlying level. As designed, the generation of LBTC should correspond strictly with the BTC locked on the main chain, but the flaw in the verification cache allowed nodes to erroneously accept minting requests that should not pass under specific conditions, so the "seemingly reserve-backed" LBTC, in fact, had no Bitcoin locked behind it.
The attack path was clearly presented on-chain: first, about 4000 LBTC without Bitcoin reserve support were minted through this vulnerability on Liquid, then following the existing process, using SideSwap's Peg-out mechanism, these approximately 4000 LBTC were exchanged for about 4000 main chain BTC. In other words, a single verification error at the protocol layer directly turned the accounting units generated from thin air in the sidechain into real BTC that could be freely disposed of on the main chain, which fundamentally struck against the narrative that "sidechain assets have sufficient reserve support," exposing that once the underlying verification logic fails, all commitments regarding security and reserves can instantly turn into technical assumptions that can be circumvented.
White hats return 3400 BTC, still with an unfilled gap
The turning point in the post-incident narrative occurred with the attackers' proactive "appearance." According to Liquid's official update on September 9, this attacker communicated several times with the official during the stage after the event was made public, claiming to be a "white hat" conducting a "good faith test," and had already returned about 3400 BTC. Compared to the approximately 4000 BTC that were previously extracted through SideSwap's Peg-out mechanism, this means that the bulk of the main chain assets were sent back, with reserves that had originally been drained from about 4205 BTC directly to about 197 BTC being partially replenished. The official press release deliberately used the phrasing "self-proclaimed white hat," rather than directly acknowledging them as cooperating security researchers, nor did it disclose any identity background or cooperation relationship, leaving a lingering ambiguity in the role positioning of the entire event.
More glaring is the figure of about 598.5 BTC that has yet to be recovered. Compared to the scale of the initial minting and extraction, this gap seems merely a "tail figure," but it represents the substantial risk exposure of Liquid's reserves, and constitutes a critical boundary for whether the white hat identity can be coherent: after unauthorized exploitation of the vulnerability, even with a substantial return, whether they still qualify to position themselves as "helping to improve security," rather than being liable for user asset compensation, currently, there is no public recourse or handling plan that provides an answer. With the gap still present and the boundary of responsibility yet to be clarified, this minting operation for BTC appears more like the start of a negotiation controlled by the attackers, while Liquid can only accept an unresolved security incident between the narrative of "self-proclaimed white hats" and the unfulfilled figures.
SideSwap Peg-out becomes the redemption channel
After the attackers completed the abnormal minting, the real transformation of the vulnerability from "accounting error" to "reserve gap" was brought about by SideSwap's Peg-out channel. According to official announcements, the attackers subsequently used this mechanism to exchange the approximately 4000 LBTC minted through the vulnerability on Liquid for about 4000 BTC on the Bitcoin main chain. SideSwap Peg-out was originally just a routine outlet for users to convert sidechain assets back to main chain BTC; however, in this incident, it became a pivotal step in directly extracting the main chain reserves with reserve-less LBTC. Because the value had already been realized through Peg-out, Liquid's Bitcoin reserves were genuinely drained in a short period, forcing the network to temporarily go offline, and the corresponding Peg-out path was also halted.
Structurally, the bridging and Peg-out mechanisms between the sidechain and the main chain act as amplifiers in the diffusion of risk and damage to main chain reserves: as long as the state on the sidechain is rewritten by the vulnerability, if the outlet still executes the conversion rules based on "formally legitimate" assets, it will directly translate the errors from the sidechain into real losses on the main chain. Such designs are often regarded in security audits as procedural "backend components," with the scrutiny focus leaning towards consensus layers and minting logic, while neglecting the outlet's ability to filter and block abnormal states. Liquid explicitly pointed out that Peg-out was exploited to extract BTC, which at least indicates that in future designs of sidechains and cross-chain bridges, outlet paths can no longer be treated as inherently secure components but must be viewed as core attack surfaces that determine the boundaries of loss.
Sidechain security myth shattered, collective risk in the Liquid ecosystem
When about 4000 LBTC were minted without reserve support and then exchanged for about 4000 BTC through SideSwap's Peg-out, draining Liquid's Bitcoin reserves from about 4205 to roughly 197 BTC, the long-packaged narrative in the world of sidechains as "faster, more private, and equally secure" appeared pale in the face of real losses for the first time. The official clearly classified the event as a protocol vulnerability at the Elements software layer, rather than operational negligence or private key leakage, meaning the problem did not lie with a specific node or custodian but with the verification logic on which the entire chain relies. Therefore, asset security and user trust were subjected to a system-level blow, not just an incident that could be attributed to "individual errors."
More disturbingly, the vulnerability lied in the underlying code of Elements related to the proof verification cache, theoretically impacting all projects or sidechains that rely on the same codebase. Although no other victim cases have been publicly reported yet, the reality of "shared tech stack equals shared potential risks" has already come to light. Following the incident, Liquid chose to take the entire system offline, elevating the repair priority to an urgent state, and advancing the Elements v23.3.4 patch, indicating that the previous investment in efficiency and privacy was not symmetrically allocated with auditing protocol boundaries and re-examination of underlying code. For the Bitcoin sidechain camp, this was not just a flaw in a single product, but rather a costly lesson on "prioritizing performance and narratives, followed by security audits," forcing all participants to recalculate the true balance between security investments and functional ambitions.
From Liquid to Bitcoin sidechains, how security audits can catch up
Looking back at this event, the weaknesses in Bitcoin sidechains and cross-chain infrastructure are concentrated precisely at the intersection of verification logic and bridging mechanisms: once the proof cache, a core verification element, is bypassed, the closed loop of "reserve support—minting—redemption" may appear normal on the books while being fundamentally distorted. For the entire sidechain camp, the directions for catching up at least include three layers: first, in code audits, no longer regard verification logic as "inherently correct" at the underlying level, but increase targeted audits and stress tests for caches, boundary conditions, and exceptional paths; second, write emergency response processes into the governance "hard rules" of the protocol, including decisions on system shutdown, information disclosure rhythms, and pre-arranged communication with potential white hats, instead of making on-the-spot decisions; third, design clearer paths for white hat vulnerability disclosure and incentive mechanisms in advance, replacing post-hoc "moral negotiations" with public bounties and accountability boundaries. Going forward, the truly noteworthy variables to monitor are: when and at what pace the Liquid network will resume operation, the extent to which the Elements v23.3.4 repair version is promoted within the ecosystem, and whether the approximately 598.5 BTC that have yet to be recovered can be properly resolved under transparent disclosure and clear handling plans.
Join our community, let’s discuss and grow stronger together!
AiCoin exclusive Hyperliquid benefits: https://app.hyperliquid.xyz/join/AICOIN88
AiCoin exclusive Aster benefits: https://www.asterdex.com/zh-CN/referral/9C50e2
On-chain Telegram community: https://t.me/AiCoinWhaleData
On-chain community: https://www.aicoin.com/link/chat?cid=N6OVMor5g
AiCoin on-chain Twitter: https://x.com/aicoinwhaledata
免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。
