[SlowMist Discloses Liquid Vulnerability Details: Attacker Minted 3,998.5 L-BTC Without Collateral, Approximately 598.5 BTC Still Unreturned] Odaily Planet Daily News – SlowMist disclosed that on September 6, the Liquid Network was attacked due to a Rangeproof verification cache key collision vulnerability. The attacker minted approximately 3,998.5 L-BTC without corresponding BTC deposits (peg-in) and subsequently exchanged them for Bitcoin mainnet BTC via peg-out within minutes. Following the incident, approximately 3,400 BTC were returned to the Liquid Federation peg wallet, but around 598.5 BTC remain under the attacker’s control. SlowMist pointed out that the root cause of the vulnerability lies in the Rangeproof verification cache key of Elements, which failed to include a length prefix when concatenating multiple variable-length fields. This led to the possibility of generating identical cache keys with different parameter combinations. The attacker constructed transactions to trigger cache collisions, causing nodes to hit the "verification passed" cache result, thereby bypassing `secp256k1_rangeproof_verify` and the minimum amount check. Ultimately, the system accepted outputs not backed by real assets and completed the minting of L-BTC. SlowMist stated that it has tracked the Bitcoin-side fund flows and completed the event analysis.