Someone turned fake L-BTC into ~4,000 real bitcoin with a cache key that had no length tags
On September 6, Liquid peg-outs redeemed thousands of L-BTC for bitcoin. Specialists say those L-BTC should never have existed. We follow the incomplete cache patch and the mainnet payouts.
On September 6, 2026, Liquid peg-outs redeemed thousands of L-BTC for bitcoin on mainnet. Specialists later argued those L-BTC should never have existed. The question this Security Lab piece answers is narrower: how did a validation shortcut turn into a real-bitcoin payout, and what does the public record actually show?
First, the basics. L-BTC is Liquid’s representation of bitcoin held by the federation. A peg-out is the exit: burn L-BTC on Liquid, receive bitcoin on mainnet. If Liquid accepts unbacked L-BTC, a peg-out can still pay real BTC against that chain state.
What the incomplete cache patch changed
Liquid hides amounts with confidential transactions. Nodes check a rangeproof (a cryptographic receipt that an amount sits in an allowed range). That check is expensive, so Elements caches successful results. On a cache hit, the node can skip the hard verify.
The cache only works if its label is unambiguous. Picture a filing label that concatenates several fields with no separators: if “proof,” “commitment,” “asset,” and “script” are jammed together without length tags, two different stacks of papers can produce the same label. CertiK and SlowMist (via CryptoBriefing) describe that kind of collision as the mechanism.
Elements commit c26d719 (“fix: range proof cache bind to asset and scriptpubkey”) shows an author date of August 3, 2026 and a committed date of September 1, 2026 on GitHub (11:39 +02:00). Neither stamp, by itself, proves when any federation machine deployed that binary.
The public patch adds asset commitment and scriptPubKey to the cache key, but still writes those variable-length fields into one SHA-256 stream without length prefixes. Matt Corallo, on Nostr the day of the drain, called it an attempted fix that was incomplete, and said the exploit used the patched code:
That was an attempted fix but in fact it was incomplete, the exploit, afaiu, exploited the patched code.
What we can measure on-chain
Whatever happened inside Liquid’s confidential world, the exit is public. Two peg-outs burned L-BTC; Bitcoin paid matching amounts.
| Liquid | L-BTC | Federation payee | Later move |
|---|---|---|---|
| ce4caece… | 3996.01834922 | bc1qgslsy… | 85d2ca15…: 3995.99999857 + 0.01834922 |
| 46f117c9… | 2.65138358 | bc1qkxwva… (not bc1ql4mfu…) | First hop only traced here |
| Sum pegged out | 3998.66973280 | 8db751a6… exact match at 14:28:56 UTC |
CertiK’s incident write-up uses about 3,998.5 L-BTC as an “affected” figure. That is a different reported quantity from our pegged-out sum of 3998.66973280. We do not treat one as a rounded version of the other.
CertiK’s cash-out table also makes 85d2ca15… look like a single 3996.01834922 payment to bc1ql4mfu…. On-chain it is a split (3995.99999857 and 0.01834922), and the 2.65138358 federation leg went to bc1qkxwva….
Later, a6d697a2… returned 3400 BTC toward the federation and left about 598.50 BTC on the consolidation path. That is the recovery fight. This article is about the validation path that made the first payout possible.
From a skipped check to a mainnet payout
Here is the sequence specialists describe. On a cache hit, the node skips the real rangeproof verify. Commit c26d719 still left the cache label undelimited, so CertiK and others argue a collision could produce that hit and let invalid outputs land in Liquid’s chain state. Once those unbacked L-BTC outputs looked valid on Liquid, peg-out policy that redeems “valid” Liquid outputs could pay bitcoin on mainnet. Which Elements binaries each signing functionary ran remains unknown.
What holders still need
A peg-out of L-BTC that should not have existed is a federation-reserve problem. Holders still need repair status, market activity, and a real path to redemption. Those are different tests.
Holder checklist: Liquid’s Bitcoin Recovery Has Three Tests. This piece maps how a cache-key failure analysis connects to the mainnet payouts we can verify.
Reporting note: Sources checked September 13, 2026. Peg-out and BTC amounts from Liquid explorers and mempool.space. Cache-key shape from Elements c26d719 (GitHub author date Aug 3, 2026; committed date Sep 1, 2026). Mechanism sketch attributed to CertiK and SlowMist (via CryptoBriefing). Still unknown here: the live primer transaction after block 4,050,335; exact functionary binaries; an independent decode of CertiK’s collision bytes (no exploit reconstruction); the full post-peg path for the 2.65138358 BTC leg beyond the first hop. Orange marks on evidence figures are ours.
