On the afternoon of September 6, 2026, roughly 4,000 BTC (about $320 million) left the federation wallet (funds jointly controlled by a fixed set of validating members, rather than by open, permissionless consensus) of Liquid Network, a Bitcoin sidechain (a separate blockchain pegged 1:1 to Bitcoin, used by exchanges for faster, confidential transfers) run by Blockstream. The withdrawal moved through SideSwap's peg-out process, a normal, approved route for converting Liquid's L-BTC back into mainchain Bitcoin (no private key was stolen). The actual cause, confirmed the next day, was a bug in Elements, Liquid's open-source software: a caching flaw in how the system checked confidential-transaction rangeproofs (the cryptographic checks that a transaction's hidden amounts are legitimate) let a previously verified proof be reused in a way that minted unbacked L-BTC. A fix for the flaw had already been merged into the public Elements code — it simply hadn't shipped to the build the network was running (The Block). Liquid paused the sidechain immediately; other Liquid-issued assets (USDT, DePix, tokenized real-world assets) were unaffected. The party holding the funds left on-chain messages identifying themselves as a white hat and asked Blockstream to patch every node before they would return anything. On September 7, Blockstream sent a PGP-signed on-chain message confirming the bridge nodes were patched; the party then returned 3,400 BTC (about $268 million, 85% of the total) and kept roughly 600 BTC (about $47 million, 15%), with no public agreement on whether that retention is a negotiated bounty (CryptoBriefing). For an allegedly unauthorized withdrawal, it is unusually well-documented — PGP signatures, cited block heights, a public patch confirmation, more procedural rigor than most protocols manage on a Tuesday.

Neither Liquid nor L-BTC is a token CryptoGrade covers, so no grade is at stake here. What the incident does is stage, in public, the exact scenario two parts of the framework exist to catch.

Security, Decentralization & Durability (18 of 100 points) weighs node count and client diversity, governance, audit quality, and a track record through at least one full market cycle. Liquid's federation is 15 named functionaries requiring an 11-of-15 multisig (at least 11 of the 15 designated signers must approve any transaction) to move funds (a small, known group, not an open validator set, and one that has run since its October 2018 launch through a full market cycle without a prior loss on this scale). The framework's answer to "does years of quiet operation prove durability?" is no: track record is one input alongside audit quality, not a substitute for it. This event shows why. The vulnerability wasn't a novel cryptographic break; a fix already existed in the public repository. The gap was deployment discipline — a merged patch that hadn't reached production, which is a governance and process failure, not merely a math one, and it is exactly what "audit quality" is scored to penalize.

Hard gate 8 (custody that can freeze, mint, or seize) is usually framed around an issuer's admin keys: does a contract give some party the unilateral power to create or lock supply. This incident is that same structural condition from a different angle. A code path capable of minting unbacked L-BTC existed whether or not the federation intended to use it, and a bug handed that capability to someone outside the federation entirely. The gate doesn't distinguish "the custodian can abuse this" from "anyone who finds the bug can"; mint authority that lives in code is a liability whether it's triggered by an insider's decision or an outsider's exploit. Any wrapped or bridged asset the framework does cover that relies on a federated or permissioned custody model carries this same category of risk, priced whether or not it has ever been exercised.