Skip to content

Repository files navigation

Liquid Implosion

Read the case study

Liquid’s incident report says a cache flaw allowed about 4,000 L-BTC without matching BTC backing. The federation’s batched Bitcoin transaction then paid 3,998.67 BTC across two peg-outs. Public explorers split at the disputed block on 6 September 2026.

The page links each claim to the public transactions, Blockstream’s statements or the relevant Elements code. A four-step walkthrough shows how different records can become the same cache input when field boundaries are missing. The real payout is shown separately.

The transactions and source code are public. The exact software builds and cached data on the servers that signed the disputed chain are not. The identity and intent of the actors are also unconfirmed.

Block production and transactions resumed on 10 September. Peg-outs remain disabled, with no reopening date. Liquid says the reserve must first be fully backed and the required software updates, testing and independent security reviews completed. SideSwap reopened peg-ins on 11 September while reporting 4,229 L-BTC in circulation against 3,627 BTC in the federation reserve.

A confirmed transaction returned 3,400 BTC. About 598.50 BTC remained at the reported address when the page was checked on 20 September at 23:41 CEST. The two public explorers agreed on the accepted chain, and an independent monitor still reported all 608 expected legitimate transactions from the abandoned fork on that chain. None of the eight tainted transactions had appeared there. Elements 23.3.4 remains the latest signed release and hardens the proof-cache keys.

This project is not affiliated with Blockstream, Liquid or SideSwap.

Local development

npm install
npm run dev

Node.js 24 or newer is required.

Verification

npm run check

The production build is a static export in out/ and is configured for the /liquid-implosion/ GitHub Pages path.

Sources

License

0BSD. You may use, copy, modify or distribute this project for any purpose, without attribution. The license includes warranty and liability disclaimers.

About

How a cache bug led to a 3,998.67 BTC payout during the September 2026 Liquid incident.

Topics

Resources

Stars

0 stars

Watchers

0 watching

Forks

Releases

Packages

Contributors

Languages