Liquid Network starts audit after $320M drain to restore Bitcoin peg-outs
CIE News ·
Liquid Network launched an external audit of Elements v23.3.4 and began updating authorization keys following a $320 million reserve exploit, though bridge peg-outs remain offline.
The Liquid Network has initiated an independent external security audit of Elements v23.3.4 to facilitate the restoration of peg-out operations following an exploit that drained roughly 4,000 Bitcoin (BTC) worth over $320 million, according to crypto.news. The September 6, 2026, security incident removed approximately 95% of the federation's reserves after an attacker created unbacked Liquid Bitcoin (L-BTC) and withdrew BTC using the network's standard peg-out mechanism.
The vulnerability occurred in the Elements codebase used to validate Confidential Transactions, certik.com reported. The issue involved ambiguous cache-key encoding within the rangeproof verification cache, which allowed different validation inputs to produce identical cached entries. Elements v23.3.4 addressed the flaw by serializing each field with a length prefix to prevent cache-key collisions.
While block production and standard transactions have resumed, bridge peg-outs remain suspended, according to crypto.news. The Liquid Federation is currently overhauling its Peg-out Authorization Key list, replacing existing entries and ensuring all receiving keys are secured in cold storage before enabling withdrawals.