Security· ★★★★· bearish·

Hacker drains 3,996 BTC from Liquid sidechain without stealing keys

  • —3,996.02 BTC (~$319M) withdrawn via SideSwap peg-out in just 36 minutes
  • —Exploit abused Elements range proof cache, accepting an unverified transaction as valid
  • —Attacker ran 70 preparatory transactions, returned 3,400 BTC, ~600 BTC still missing
  • —Blockstream released Elements 23.3.4 with a fix to the cache structure
Why it matters: The incident exposes the risks of federated sidechains and automated peg-outs lacking limits or manual review.
#BTC
Source: Blockmedia
More on this
Security · Sep 14
Hacker mints 46.1B fake BTC on Symbiosis bridge, steals $336,000
 Security · Sep 22
SlowMist warns of Safari zero-day on iPhone stealing crypto keys and seed phrases
 Security · 11:17
WaterPlum Hackers Steal $10.7M From 7,000 Wallets