On September 6, 2026 an attacker exploited a consensus vulnerability in Elements’ rangeproof verification cache to create roughly 4,000 unbacked LBTC and move it through Liquid’s peg-out process, producing a Bitcoin withdrawal of about 4,000 BTC (confirmed in Bitcoin block 965,783). Smaller earlier peg-outs drained the reserve from ~4,205 BTC to ~197 BTC. The attacker identified themselves on-chain and returned 3,400 BTC on September 7; approximately 602 BTC remain outstanding. Liquid’s design - 15 geographically distributed functionary nodes with 11-of-15 block signing, confidential transactions using Pedersen commitments and rangeproofs, and a two-key Peg-out Authorization Key (PAK) model separating an offline receiving xpub from an online signing key - meant the exploit combined a consensus verification flaw with a gap in one member’s PAK signing configuration to enable the theft.
Root cause analysis found Bug A: a 2018 change that removed asset commitment and scriptPubKey from the rangeproof cache key so cached verifications could be reused in incorrect contexts, producing consensus mismatches; a related byte-boundary issue (Bug B) remained undetected by an initial fix. The defect was reported August 2, 2026, and rapid internal and external reviews converged on the root cause. Response actions included halting bridge nodes, deploying an emergency interim patch within hours, shipping Elements v23.3.4 as a full hardening release within days, and expanding AI-assisted legacy-code review and other corrective measures to prevent recurrence.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
China has implemented new travel regulations that are causing concern among technology companies and professionals. These rules are impacting the movement of talent and the operations of tech giants within the country. (dw.com)
OSCE's ODIHR organization will now consider reports of alleged election fraud in Sweden for future assessments. Several criminal investigations into suspected vote-rigging and vote-buying have been launched after the recent election, along with a surge in election result appeals. (tv4.se)
A Reddit moderator was ordered to pay Nintendo $4.5 million for operating Switch piracy shops. Nintendo accused James 'archbox' Williams of running illegal stores selling pirated Switch games. (theverge.com)
Nearly half of 4,688 small-business websites in a 2026 study did not implement any of seven key security headers. The study highlights widespread gaps in web security practices among small local businesses. (rackcrunch.com)
The Cutting Room Floor wiki was taken offline after a DDoS attack allegedly triggered by an banned AI user using Claude Code. The user reportedly evaded a ban, provoked anti-AI content, and sent abuse reports to the hosting provider. (kotaku.com)
A vulnerability in ansi2html.py allowed attackers to inject malicious scripts into build logs on builds.sr.ht, leading to account takeovers through XSS exploits. The flaw was wormable, affecting viewers of compromised logs and highlighting security risks in CI platforms. (blog.arusekk.pl)
Today's best Hacker News stories, summarized and screenshotted, one email a day.