Blockstream: Elements consensus bug exploited to issue unbacked LBTC and withdraw about 4000 BTC from Liquid's reserve
On September 6, 2026, an attacker exploited a vulnerability in Elements' rangeproof verification cache: according to Blockstream's report, the attack used Bug B — an error in constructing the cache key when combining fields. This allowed about 4000 LBTC to be issued without backing bitcoin, after which the funds left through the standard peg-out process; Liquid's reserve fell from about 4205 BTC to 197 BTC. The attacker returned 3400 BTC, while about 602 BTC remains unreturned; other Liquid assets (USDt, DePix and others) were not affected, but were unavailable during the network halt. Blockstream stopped the bridge nodes, rolled out an urgent temporary patch and then released the reviewed Elements v23.3.4.
Elements/Liquid node operators should update to Elements v23.3.4 immediately, without waiting for a scheduled window: the vulnerability was confirmed to have been exploited on mainnet, and older builds may diverge from the network in their validation results. LBTC holders should account for the fact that part of the reserve has not been restored, and check peg-out availability before large operations; the report and release are linked in the post.
Sources: