elements range proof · Aqua Wallet
Update to incident: ~4,000 BTC withdrawn from Liquid Federation wallet; Liquid network suspended
Blockstream identifies cause of Liquid incident: range proof vulnerability in the Elements protocol
The official report on the incident involving an unauthorized withdrawal from the Liquid Federation wallet (relayed through Aqua Wallet) names the technical cause for the first time: a vulnerability in the Elements protocol's range proof mechanism, rather than only the use of a Peg-out Authorization Key, as previously stated. The Liquid network itself has still not returned to normal operation.
Source: x.com - AquaBitcoin
Incident history
- 06 Sept~4,000 BTC withdrawn from Liquid Federation wallet; Liquid network suspended
- 07 SeptAbout 4,000 BTC withdrawn without authorization from Liquid Federation wallet; some already returned
- 08 SeptBlockstream deploys updated software and prepares a coordinated restart of the Liquid network
- 08 SeptBlockstream identifies cause of Liquid incident: range proof vulnerability in the Elements protocol
- 08 SeptBlockstream: Liquid network restart expected in 4–5 days
- 09 SeptFollowing the Liquid incident, a wave of phishing impersonating Blockstream and Liquid
- 10 SeptLiquid produces blocks again, but without transactions for now; peg operations remain suspended
- 10 SeptLiquid transactions are going through again; peg operations remain suspended for now
- 10 SeptLiquid resumes transactions, peg-outs remain disabled; node operators urged to update Elements immediately