Tag: Cryptocurrency Exploit

  • Liquid Network Recovers 3,400 BTC After Weekend Exploit — 600 BTC Still Unaccounted For

    Liquid Network Recovers 3,400 BTC After Weekend Exploit — 600 BTC Still Unaccounted For

    Liquid Network recovered 3,400 BTC (worth approximately $268 million) on Monday after a weekend exploit drained nearly 4,000 BTC from its reserves. However, about 600 BTC, representing 15% of the stolen amount, remains under the attacker’s control. L-BTC deposits and withdrawals remain suspended as operators work toward a safe restart.

    Elements Bug Allowed Unbacked L-BTC Creation

    Liquid disclosed the attack on September 6, confirming that stolen private keys were not the cause. SideSwap also stated its systems were not breached during the incident. Instead, the vulnerability originated from Elements, the Bitcoin Core fork that powers Liquid. A range-proof verification cache bug apparently allowed the creation of L-BTC without matching Bitcoin backing. The attacker then used those unbacked tokens to obtain real BTC through Liquid’s normal peg-out process. Liquid took its federation wallet and bridge nodes offline after detecting the abnormal withdrawals.

    Hacker Returns Most Funds After Patch

    The self-described white-hat hacker pledged to return most funds after Blockstream fixed the underlying software flaw. In messages to Blockstream, the party requested that patches be deployed across every node before returning Bitcoin. Blockstream later confirmed its bridge nodes had received the patch and could safely accept the funds. Onchain data then showed 3,400 BTC moving back to the Liquid Federation wallet. Approximately 598.5 BTC remains under the actor’s control, with no public agreement explaining whether those coins represent a bounty or a planned further return.

    Ledger Chief Technology Officer Charles Guillemet questioned the white-hat label after the partial repayment, stating that keeping roughly 600 BTC did not fit a genuine bug-bounty arrangement and described it as closer to extortion. The return removed most of the immediate reserve shortfall but did not restore normal Liquid operations. The network still needs to verify backing and complete software deployment before reopening its bridge.

    Liquid Keeps Peg Services Paused

    Liquid has not resumed normal operations while its operators prepare a safe restart. L-BTC deposits and withdrawals remain halted, affecting related services at centralized exchanges. Meanwhile, Bitcoin’s main network continues operating without disruption. The exploit also left other Liquid-issued assets untouched, including USDT, Depix, and real-world assets. Liquid wallets such as Aqua face disruption only across their Liquid functions; users can access unaffected Bitcoin network services while Liquid peg activity remains unavailable.

    Before reopening the bridge, operators need to restore one-to-one backing for legitimate L-BTC, distribute the patched Elements release across the network, and verify safe bridge operation. Liquid has not explained how it will cover any remaining gap in L-BTC backing, nor has it published a timeline for restoring the sidechain and its peg services.

  • Solido Foundation Loses 90% of Stolen SUPRA Tokens in Oracle Price Exploit

    Solido Foundation Loses 90% of Stolen SUPRA Tokens in Oracle Price Exploit

    Solido Money has reported a major DeFi exploit in which attackers drained 293.7 million SUPRA tokens by exploiting a pricing error in its Solido Cash protocol. The stolen tokens were valued at approximately $900,000 at the time of the attack on July 23, 2026. According to blockchain security firm PeckShield, about 90% of the affected funds belonged to the Solido Foundation, exacerbating the project’s financial strain as its total value locked fell below $1 million and SUPRA traded near historic lows.

    Oracle Error Enabled Two Exploit Waves

    Solido’s forensic review traced the breach to an oracle misassignment involving SOLID, a token used as backstop collateral. A stale price feed triggered fallback logic that valued SOLID far above its actual market price. The attacker used the inflated collateral value to mint CASH without sufficient backing, then exchanged the newly created CASH for SUPRA, removing tokens from trading pools.

    The first wave began at 18:21 UTC and used a single transaction to swap tokens, deposit collateral, mint CASH, and sell it, producing approximately 266.8 million SUPRA. About three hours later, the attacker repeated the method through five wallets, generating another 26.9 million SUPRA. Together, both waves created 809,051.55 CASH in new debt and extracted 293,705,544.97 SUPRA. The incident was classified as a pricing-path defect combined with weak risk limits, ruling out reentrancy or direct market manipulation. Solido noted that its liquidation system operated during both waves, but front-end controls alone did not stop the later transactions from reaching the contracts on July 23.

    Most Stolen SUPRA Reached Exchanges

    On-chain tracing revealed that roughly 246.9 million SUPRA, or 84% of the proceeds, reached centralized exchange infrastructure. About 220 million SUPRA moved to a suspected Gate deposit address. Solido stated that blockchain activity alone cannot confirm who controls that address; Gate would need to verify whether it belongs to its platform and whether the funds remain available for restriction. Another 26.9 million SUPRA reached an unidentified exchange-linked address, while the remaining 46.8 million SUPRA stayed on-chain and had not moved when the forensic report was prepared.

    Solido has asked the exchanges to confirm flagged accounts, preserve records, and restrict traced deposits where law allows. The team clarified it is not seeking broad account freezes or accusing any exchange of knowingly assisting the attacker.

    Foundation Loss Deepens Market Pressure

    Solido emphasized that the attacker did not drain depositor balances or borrower positions. Instead, the attacker opened new positions using overvalued collateral rather than removing assets from individual lending accounts. Liquidity providers bore the loss after the attacker exchanged unsupported CASH for SUPRA in market pools. Solido Flow was not targeted, but the team paused the staking product as a safety measure.

    Between 23:05 and 23:12 UTC on July 23, Solido disabled all six collateral listings and closed the minting route used during the attack. The protocol remains paused while the team tracks funds and prepares recovery steps. DeFiLlama lists Solido’s combined total value locked at about $664,000. SUPRA traded near $0.00025 on July 28 and had lost about 94% over the previous year. The exploit added further selling pressure while the foundation faced a large reserve shortfall.