AI reproduced Liquid’s $320M exploit in an hour

Alpen Labs reported that its automated AI agents traced and locally reproduced the proof-check failure that allowed Liquid to release about 3,996 BTC on Sept. 6. At the time the bitcoin payout was roughly $320 million.

The company published a technical account on Sept. 22 that links the failure to a Sept. 1 code change in Elements, the software that validates Liquid state. The change built a cache key for range-proof verification by concatenating several fields as raw bytes without encoding field boundaries. That allowed a valid “seed” proof and a different, invalid target to produce the same cache input. A cache lookup then bypassed the full verification and accepted the invalid target.

Alpen noted its replay was performed after funds left and used source code and chain evidence because exact production binaries and historical cache contents were not available. Elements issued repairs on Sept. 8 that encoded field lengths into cache keys, added tests focused on collisions and provided an option to bypass the range-proof cache. Version 23.3.4 followed on Sept. 9.

SideSwap provided a transaction timeline showing an attacker sent 4,000 L‑BTC to its peg-out at 14:05 UTC on Sept. 6. SideSwap burned the tokens with valid authorization at 14:06. Two attempted payouts later failed because the order exceeded the service’s wallet balance. Federation signers released about 3,996 BTC at 14:28, and the full bitcoin amount was forwarded to the recipient in the same block.

SideSwap reported its authorization key was online and that payouts were processed automatically. The service stated it had no size, velocity, supply-relative, wallet-history or human-review checks on peg-outs. A private security build the service ran in August accepted the attack transaction. Federation signers approved an exceptional signing request after the two failed payout attempts.

Controls such as payout limits, an offline authorization key or a delayed manual forward operate at different stages: before proof acceptance, before federation signing, or before on-chain transfer. The stage at which a control sits determines which failures it can affect.

Liquid reported on Sept. 17 that ordinary sidechain transactions had resumed while peg-outs remained paused. The network stated withdrawals will restart only after one-to-one bitcoin backing is confirmed and required software updates, testing and independent reviews are complete. It remains unclear whether the resumed peg-out process will include independent checks that can stop reserve-sized authorized requests before bitcoin leaves federation custody.