Skip to content

Back to the catalog

How The $320M Exploit of Liquid Network Went Down
chainalysis.comwriteup

How The $320M Exploit of Liquid Network Went Down

Chainalysis breaks down the $320M exploit of Blockstream's Liquid Network, a Bitcoin sidechain, in which purported white-hat hackers exploited a flaw in how Liquid's software cached cryptographic verification results for its Confidential Transactions range proofs. By getting valid proof data cached and then submitting different invalid data that mapped to the same cache key, attackers bypassed full re-verification and minted thousands of unbacked L-BTC tokens, which they exchanged for ~4,000 real BTC (of ~4,200 held) via the peg-out process. The actors negotiated with Blockstream via on-chain OP_RETURN messages and returned 85% of the funds (3,400 BTC) after Blockstream patched the bug and confirmed nodes were updated, keeping roughly $47M.

TL;DR A cache-collision flaw in Liquid Network's confidential-transaction proof verification let attackers mint unbacked L-BTC and drain $320M in BTC, 85% of which was returned after Blockstream patched the bug.
Open original ↗

Organisations named here

  • OP_RETURN
  • peg-out
  • range proof

Technologies named here

  • Liquid Network
  • L-BTC
  • Bitcoin
  • Blockstream

Threat actors named here

  • Purported white-hat hackers

Related in Blockchain