SlowMist: Liquid Network Flaw Enabled Unbacked Mint of 3,998.5 LBTC; 598.5 BTC Still Outstanding

Odaily Planet Daily reports that blockchain security firm SlowMist said on X that Liquid Network was exploited on Sept. 6 due to a vulnerability involving a rangeproof verification cache key collision. SlowMist said the attacker minted about 3,998.5 LBTC without corresponding BTC peg-ins, then executed peg-outs within minutes to swap the tokens into Bitcoin mainnet BTC. Following the incident, roughly 3,400 BTC were returned to the Liquid Federation peg wallet, while about 598.5 BTC remains under the attacker's control. According to SlowMist, the issue stems from the Elements implementation of the rangeproof verification cache key: when multiple variable-length fields are concatenated, no length prefix is included, allowing different parameter sets to produce identical cache keys. By crafting transactions that induced cache collisions, the attacker caused nodes to reuse a cached "verification passed" result, bypassing both the secp256k1_rangeproof_verify function and the minimum amount check. As a result, nodes accepted outputs not backed by real assets, enabling the uncollateralized LBTC mint. SlowMist said it has tracked fund flows on the Bitcoin sidechain and completed its incident analysis.