News linked to both this project and an event.
SlowMist has disclosed that the Liquid Network was attacked on September 6 via a Rangeproof verification cache key collision vulnerability. The attacker minted approximately 3,998.5 L-BTC without collateral — with no corresponding BTC peg-in — and then within minutes converted them to BTC on the Bitcoin mainnet via peg-out. After the incident, approximately 3,400 BTC was returned to the Liquid Federation peg wallet, but approximately 598.5 BTC remains under the attacker's control.SlowMist noted that the root cause of the vulnerability lies in the fact that the Rangeproof verification cache key in Elements did not include length prefixes when concatenating multiple variable-length fields, allowing different parameter combinations to potentially generate the same cache key. The attacker triggered a cache collision by constructing transactions, causing nodes to hit a "verification passed" cached result, thereby bypassing secp256k1_rangeproof_verify and the minimum amount check, ultimately accepting outputs not backed by real assets and completing the L-BTC minting. SlowMist stated that it has traced the fund flows on the Bitcoin side and completed its analysis of the incident.
According to on-chain monitoring by analyst PeckShield (@PeckShieldAlert), the Liquid Network was targeted by white-hat hackers. Approximately 4,000 BTC (roughly $320 million) were transferred from a Liquid Federation wallet. The funds were consolidated into address bc1ql4mfu6aundtkksxklfajs2h3t9nzcd6gyqjlte, accompanied by an on-chain message: "We are white hats, please contact us on-chain." Subsequently, the hackers completed on-chain negotiations with Blockstream, returning 3,400 BTC (approximately $315 million, or 85% of the total) while retaining around 598.5 BTC (about $47.38 million) as a bug bounty.
on-chain investigator ZachXBT has released verification information, stating that crypto exchange AscendEX has officially announced its cessation of operations, and the platform's current liquid assets are almost insufficient to cover user withdrawal demands. According to the platform announcement, the shutdown is primarily due to market conditions and the EU MiCA regulatory framework. Starting July 1st, all services including account opening, trading, and deposits will be fully suspended, with only basic functions such as account inquiry and withdrawals remaining open. After July 6th, all withdrawal channels will cease automatic processing and switch entirely to manual review. The official team has candidly warned that withdrawals may be significantly delayed or even impossible to process.ZachXBT’s investigation found that pending user claims amount to millions of dollars, yet the platform’s available liquid assets in hot wallets are severely insufficient. AscendEX is currently evaluating its financial status and a plan for handling user assets, with subsequent arrangements to be announced separately.
According to The Block, multi-asset trading platform Liquid launched its Co-Invest application on Tuesday, enabling users to directly top up their accounts, conduct market analysis, and execute live trades within the ChatGPT and Claude chat interfaces—without leaving the AI assistant.
According to on-chain analyst Onchain Lens (@OnchainLens), publicly listed mining company Bit Digital (@bitdigital_btbt) has staked 29,900 ETH via Liquid Collective (@liquid_col), valued at approximately $65.3 million.