Technical Flaw Linked to $320 Million Liquid Network Exploit

New details have surfaced regarding the $320 million incident on the Liquid Network. Investigators believe a failure in the software’s transaction validation cache allowed for the creation of unbacked L BTC tokens. These tokens were then redeemed for real Bitcoin through the SideSwap service. The core of the issue involves range proofs, which normally ensure that transaction amounts stay within valid limits. A technical flaw reportedly allowed an attacker to bypass these checks by crafting a transaction that matched a previously verified result in the system cache.

The situation highlights a potential gap in software deployment. Some reports suggest that the vulnerable code entered the master development branch just one week before the exploit, though it had not yet been included in an official tagged release. While some nodes on the network correctly rejected the invalid transactions, federation functionaries running the affected software accepted them, which facilitated the release of the funds.

This discrepancy between different nodes explains why the incident remained unclear for some time. While explorers following the rejecting nodes showed a normal ledger, others saw the irregular activity. Those currently holding the stolen Bitcoin claim they are acting as whitehats, holding the funds until the network flaw is addressed. For the Liquid Network, the focus is now on confirming the exact software versions used during the incident and ensuring that the fix prevents these specific cache collisions from happening again.