News linked to both this project and an event.
Odaily News: According to Bitcoin News monitoring, its latest newsletter reviewed multiple security incidents over the past eight weeks involving projects that Bitcoin users rely on in their daily activities, with a focus on the latest major exploit targeting Liquid Network.
Odaily News: On-chain security platform Blockaid has discovered a vulnerability in the Bitcoin bridge of cross-chain protocol Symbiosis. The attacker minted approximately 2^62 syBTC to a newly created externally owned account, with a face value of roughly $46.1 billion calculated at 8 decimal places, and sold approximately 4.39 WBTC on Uniswap V4 on Ethereum, realizing a cash-out of about $336,000.Symbiosis stated that the attack occurred at around 4:28 AM on September 11. The team has paused the BTC route, while other routes remain operational and unaffected. The team has recovered approximately 15 BTC and deposited them into a multisig wallet controlled by the team. They have also offered the attacker a 20% white-hat bounty, with a deadline of September 13.In recent weeks, Liquid Network, Nomic, and Symbiosis have all experienced security incidents involving the inflation of supply through the minting of tokens without real asset backing. As of September 13, Symbiosis has not yet publicly released a BridgeV2 technical post-mortem, the final loss amount, or confirmation of whether the attacker has accepted the bounty. (Bitcoin.com News)
SlowMist has disclosed that the Liquid Network was attacked on September 6 via a Rangeproof verification cache key collision vulnerability. The attacker minted approximately 3,998.5 L-BTC without collateral — with no corresponding BTC peg-in — and then within minutes converted them to BTC on the Bitcoin mainnet via peg-out. After the incident, approximately 3,400 BTC was returned to the Liquid Federation peg wallet, but approximately 598.5 BTC remains under the attacker's control.SlowMist noted that the root cause of the vulnerability lies in the fact that the Rangeproof verification cache key in Elements did not include length prefixes when concatenating multiple variable-length fields, allowing different parameter combinations to potentially generate the same cache key. The attacker triggered a cache collision by constructing transactions, causing nodes to hit a "verification passed" cached result, thereby bypassing secp256k1_rangeproof_verify and the minimum amount check, ultimately accepting outputs not backed by real assets and completing the L-BTC minting. SlowMist stated that it has traced the fund flows on the Bitcoin side and completed its analysis of the incident.
Bitcoin News posted on X stating that Samson Mow and Bitcoin Red Team researcher Calle are engaged in a public dispute over whether security warnings related to a Liquid Network exploit were properly handled. Calle claims that Blockstream did not act on the Red Team's email, ultimately resulting in a loss of 600 BTC; Mow responded by saying "no email was ignored." Calle stated that once Blockstream restores normal Liquid operations and publishes a post-mortem report, the Red Team will release a full account of the disclosure process. Mow separately warned against blindly trusting AI-generated security reports, saying that unverified fixes could introduce new vulnerabilities, and criticized researchers who prioritize pursuing "clout" over protecting Bitcoin.
Liquid Network resumed empty block production after deploying an emergency patch, following a core software vulnerability that resulted in nearly $320 million in assets being withdrawn. Asset recovery and system stability monitoring are currently ongoing.
Liquid Network announced on X platform that as of September 10 at 10:00 (UTC), the network has entered a controlled recovery phase. As a precautionary measure, the network has resumed block production but is not yet processing transactions, and is continuously monitoring to confirm full network stability. Blockstream stated that the required Functionary node and bridge node updates have been successfully deployed, and Functionary nodes are now signing and validating blocks as expected. Meanwhile, pegging operations, including PAK-authorized Peg-out, remain paused, and the network is in the final recovery phase, including restoring BTC/LBTC reserves. Liquid Network reminds users to be wary of scammers using this incident to publish fake update websites or messages, and to never transfer funds to unknown channels or disclose private keys or seed phrases.
Odaily News: Liquid Network announced that the emergency release Elements v23.3.4 is now live, with Functionary nodes having immediately begun upgrades. All Liquid node operators are advised to update accordingly. This release addresses a previously identified Proof validation cache vulnerability by strengthening the cache keys used for Range Proofs.Regarding network recovery, Blockstream stated that a recovery plan is still being formulated, expected to proceed in three phases: **resume block production while continuing to pause Peg operations; replay verified valid transactions; restore Peg operations after the network state is fully recovered and fund returns are confirmed.** Currently, the first two phases are being tested in parallel, and any phase will only advance once confirmed secure.Liquid Network stated that Elements v23.3.4 has undergone multiple rounds of internal and external reviews, with participants including the Bitcoin Red Team, Alpen Labs, and other teams. Meanwhile, Liquid Network reminds users to be wary of fake upgrade websites exploiting this incident for scams. Information should only be obtained through official Liquid Network and Blockstream channels, and users should never send funds to strangers or disclose private keys or seed phrases.
Liquid Network's official security incident report: On September 6, a vulnerability related to the range proof verification method in Liquid node caching within the open-source software Elements was exploited, resulting in the creation of approximately 4,000 LBTC tokens not backed by bitcoin reserves. The exploiter subsequently exchanged them for approximately 4,000 BTC via SideSwap and the Liquid standard Peg-out mechanism. Prior to the incident, Liquid's reserves stood at approximately 4,205 BTC. After the relevant Peg-out and other withdrawals completed before the network halt, reserves fell to 197 BTC.According to the official statement, the incident did not involve the compromise of Functionary nodes or private keys, and other issued assets on Liquid such as USDT were also unaffected by the vulnerability. The exploiter claimed to be a white hat security researcher and returned 3,400 BTC to the Liquid Federation Peg wallet on September 7. Approximately 598.5 BTC (about 15% of the funds involved) remain unrecovered, and Blockstream is in communication to recover the remaining assets.At present, the top priority is to recover the remaining funds and restore Liquid Network to normal operation as quickly and safely as possible. A fix for the vulnerability has been developed and is currently undergoing multiple rounds of internal and external review. Blockstream is preparing to urgently release Elements v23.3.4, which is expected to be rolled out as soon as preparations are complete, with a target launch within approximately 48 hours. Following the software update, Liquid Network Functionary operators will make further adjustments to restore full network functionality and resume a corrected network state, including rejecting previously invalid Peg-outs.
Odaily News, according to Bitcoin News, Blockstream stated that Liquid Federation members are preparing to coordinate a network restart, with the updated software already deployed. Previously, a security incident occurred on the Liquid Network, resulting in fund transfers. Blockstream noted that its team remains focused on further strengthening the network and ensuring asset restitution. Blockstream thanked the Bitcoin community for its patience, support, suggestions, and assistance, and stated that more updates will be released in the future.
According to Odaily, monitoring by Galaxy's Head of Research revealed that Liquid's white hat hacker stated they would return most of the 4,000 BTC after the Liquid Network vulnerability is patched. The hacker communicated with Blockstream through OP_RETURN messages and PGP-encrypted text: In block 965,822, a Blockstream address sent 1,000 satoshis with the message "Please contact the security team via the Blockstream website"; in block 965,865, the hacker sent an encrypted message to their own key, accompanied by a detached PGP signature that can be verified using the key published by Blockstream; in block 965,869, the hacker sent 1,000 satoshis to the Liquid federation peg-in wallet via a self-spend transaction with the message "Can we return the majority of the funds to the federation address?"; in block 965,875, the hacker conducted another self-spend transaction, sending 1,000 satoshis to the federation peg-in wallet and leaving an OP_RETURN message: "Please fix the vulnerability first. As of the latest commit, there is risk on-chain. Please ensure every node completes the patch update. Once the fix is confirmed, we will securely transfer the funds back." Relevant technical details were encrypted via PGP messages to the key published by Blockstream, readable only by Blockstream.
Odaily News - Liquid staking protocol Lido has announced an update to the EarnETH Vault fee structure, adopting a more flexible performance-linked fee model to reduce holding costs for users and strengthen the alignment between yield distribution and product performance.Under the new structure, EarnETH fees will shift from the previous "1% AUM fee + 10% performance fee" to a maximum of "0.5% AUM + 20% performance fee" model. The new fee structure will launch with "0.2% AUM + 15% performance fee," with any future adjustments to be announced separately.Lido stated that reducing the management fee from 1% to 0.2% will lower the cost of holding EarnETH for users in low-yield environments, while the increased performance fee ratio will better tie protocol revenue to the Vault's actual performance. All currently effective fees will be transparently displayed on the EarnETH Vault interface.This adjustment aims to optimize the fee mechanism of the EarnETH yield product, enhance fee flexibility, and strengthen alignment between users and the product's yield performance.
Odaily News: Digital asset investment platform Rockawayx has acquired digital asset hedge fund Relayer Capital, incorporating its directional long/short strategy into its approximately $2 billion investment platform. Relayer Capital founder Austin Barack will continue to oversee the strategy and assume the role of Chief Investment Officer of the newly renamed Rockawayx Liquid Opportunities Fund.Rockawayx CEO Viktor Fischer stated that the fund will invest in highly liquid crypto tokens and digital asset-related equities, with a focus on identifying assets that are mispriced relative to their business fundamentals, market position, or growth prospects. The fund is currently open to new external investors.Rockawayx disclosed that the strategy's estimated net return from the start of 2026 through August 21 stands at approximately 70%, outperforming a weighted portfolio of Bitcoin, Ethereum, and Solana by 86 percentage points. Major contributing positions include Venice AI, Hyperliquid, Grass Network, Pump.fun, and Zcash, with investment themes centered on AI and tokenized real-world asset markets.The acquisition adds a directional liquid strategy to Rockawayx's venture capital and market-neutral businesses. Rockawayx also operates infrastructure and onchain liquidity divisions, noting that these capabilities support its team in identifying blockchain market opportunities across stages—from early-stage funding and token issuance to public market trading. (Bitcoin.com News)
: Asset tokenization platform Centrifuge has announced its integration with Liquid Lane, a liquidity network launched by Symbiotic, to provide on-chain liquidity support for three of its tokenized funds, covering fund products with approximately $1.6 billion in assets under management.The integration involves Janus Henderson's JAAA (AAA-rated collateralized loan obligation strategy fund), JTRSY (short-term U.S. Treasury strategy fund), and NYLIM's HYB (U.S. high-yield corporate bond fund). Through Symbiotic Liquid Lane, eligible fund holders can exchange their fund tokens for USDC via an on-chain request-for-quote (RFQ) market, enabling instant liquidity. This mechanism allows market makers to draw funds from liquidity vaults to meet investor redemption demands, and subsequently redeem fund tokens through the issuer or sell them in other RFQ transactions.Centrifuge stated that this solution separates investors' instant access to USDC liquidity from the traditional fund redemption process, making tokenized funds more adaptable to the trading demands of on-chain financial markets. (Cointelegraph)
on-chain investigator ZachXBT has released verification information, stating that crypto exchange AscendEX has officially announced its cessation of operations, and the platform's current liquid assets are almost insufficient to cover user withdrawal demands. According to the platform announcement, the shutdown is primarily due to market conditions and the EU MiCA regulatory framework. Starting July 1st, all services including account opening, trading, and deposits will be fully suspended, with only basic functions such as account inquiry and withdrawals remaining open. After July 6th, all withdrawal channels will cease automatic processing and switch entirely to manual review. The official team has candidly warned that withdrawals may be significantly delayed or even impossible to process.ZachXBT’s investigation found that pending user claims amount to millions of dollars, yet the platform’s available liquid assets in hot wallets are severely insufficient. AscendEX is currently evaluating its financial status and a plan for handling user assets, with subsequent arrangements to be announced separately.
According to CoinDesk, crypto infrastructure firm Symbiotic has launched Liquid Lane, a liquidity network enabling investors to convert tokenized funds, private credit, and other real-world assets into stablecoins nearly instantly—replacing traditional redemption periods of up to 180 days.
According to The Block, multi-asset trading platform Liquid launched its Co-Invest application on Tuesday, enabling users to directly top up their accounts, conduct market analysis, and execute live trades within the ChatGPT and Claude chat interfaces—without leaving the AI assistant.
The Zcash Foundation released its Q1 2026 report, disclosing total liquid assets of approximately $36.7 million, including roughly $12.11 million in cash, 506,556 USDC, 85,412 ZEC (valued at ~$21.2 million), 41.8 BTC (valued at ~$2.85 million), and 12.02 ETH (valued at ~$25,000). The Zcash Foundation added that, although the first quarter of this year saw personnel changes within the Electric Coin Company’s development team and governance-related disputes, network operations remained unaffected, with transactions and block production continuing normally. On the regulatory front, the U.S. Securities and Exchange Commission (SEC) has concluded its investigation without taking any enforcement action, thereby resolving long-standing regulatory uncertainty.
According to Businesswire, Paystand, a blockchain-based B2B payment network, has announced the launch of USDb, a stablecoin built on the Bitcoin ecosystem. USDb is backed 1:1 by U.S. dollar reserves and is natively deployed on the Bitcoin sidechain Rootstock, while also being compatible with the Liquid Network and the Bitcoin Lightning Network. Notably, USDb is primarily designed for traditional corporate finance use cases, including accounts receivable/payable, cross-border payroll, and treasury management.
Polygon has officially launched its native liquid staking token, sPOL, designed to enhance returns for POL token stakers. As Polygon’s native liquid staking token, sPOL unlocks approximately 3.6 billion staked POL tokens and grants stakers priority access to transaction fee revenue sharing. Currently, only about 4%–5% of POL is liquid; sPOL addresses the issue of idle capital being unable to participate in DeFi yield opportunities. Users can migrate existing stakes to sPOL via the Polygon Staking Portal—without waiting periods and with uninterrupted rewards—while new stakes will automatically receive sPOL. The initial sPOL redemption ratio is 1:1, increasing as staking rewards accrue. sPOL supports liquidity provision, collateralization, and yield-boosting DeFi strategies, and can be redeemed at any time for POL plus accumulated rewards. The token was initially launched by Polygon Labs and audited by ChainSecurity and Certora; official liquidity will be seeded through an on-chain liquidity pool. Polygon cautions that sPOL carries smart contract risk, validator misbehavior penalty risk, and market volatility risk.