Researchers investigating the roughly $320 million Liquid Network incident have identified an alleged transaction-validation cache failure that could have allowed unbacked L-BTC to be redeemed for real Bitcoin. Liquid is a Bitcoin sidechain whose L-BTC tokens are intended to be backed one-for-one by BTC held by its federation. Calle’s technical account centers on range proofs, which check that hidden transaction amounts remain within permitted limits, and on cached verification results that an attacker allegedly manipulated through a cache-key collision. Stu’s reconstruction places setup transactions and an allegedly invalid transaction at Liquid block 4,050,336, with about 3,996.0183 L-BTC created before SideSwap processed a withdrawal of approximately 3,996 BTC. Mononaut said federation functionaries accepted the exploit transactions and continued producing blocks, while other nodes rejected the affected block. He also said the exploited code had entered Elements’ master development branch the previous week but had not appeared in a tagged release; Blockstream has not confirmed that deployment account in the available statements. SideSwap said its customer submitted 4,000 L-BTC through its peg-out service on Sept. 6. The actors holding the withdrawn Bitcoin describe themselves as whitehats and have conditioned the return of most funds on a fix being deployed across affected nodes. No completed return or patch rollout has been established.