Ledgers Academy Letter
The Daily Ledger: 8 September 2026
Liquid's incident report says a range-proof caching bug in Elements let attackers mint about 4,000 unbacked L-BTC and peg out real bitcoin. Visa's stablecoin settlement passes a $20 billion annualised run rate.
Subject: How 4,000 unbacked L-BTC were created on Liquid
Preview: The incident report names a caching bug in Elements, Visa's stablecoin settlement passes a $20 billion run rate, and the Bundesbank tests a permissioning engine.
THE DAILY LEDGER
8 September 2026
Liquid explains how counterfeit bitcoin was minted on its sidechain, Visa reports sharply higher stablecoin settlement, and Germany's central bank starts testing institutional blockchain software
Editor's note: market data reflects the 23:59 UTC daily close on 8 September 2026 (01:59 Europe/Stockholm on 9 September). News was checked to 23:00 UTC.
Liquid published an incident report at 19:10 UTC explaining Sunday's loss of about 4,000 BTC. No keys were stolen and the federation was not broken into. A software bug let attackers create bitcoin on the sidechain that nothing was backing, then redeem it for the real thing.
1. The Day in Numbers
- Bitcoin: $78,456 at the 23:59 UTC close, down 0.8 percent over 24 hours.
- Ether: $2,485 at the 23:59 UTC close, down 0.2 percent over 24 hours.
- Fear and Greed Index: 69, Greed, two points below Monday.
- Rate expectations: the CME FedWatch tool showed above 60 percent implied odds of a rate increase at the 15 and 16 September FOMC meeting, as reported on 8 September. Implied odds are a market price, not a forecast, and they move daily.
2. How the Liquid Network exploit worked
Liquid is a Bitcoin sidechain. Bitcoin sent to it is locked in a wallet controlled by a federation of companies, and an equivalent token called L-BTC is issued in return. Liquid also uses confidential transactions, which hide amounts. To keep hidden amounts honest, each transaction carries a range proof: a cryptographic proof that a concealed number is valid without revealing it.
According to the incident report, on 6 September at 15:53:10 UTC, at Liquid block 4,050,336, a flaw in how Elements nodes cache range-proof verification results was exploited to create about 4,000 unbacked L-BTC. Caching verification results is a normal way to make a node faster. The danger is that a cached result can be trusted without the work behind it ever having been done.
The attackers then sent that counterfeit L-BTC through SideSwap's authorised peg-out path. Nodes treated the tokens as genuine and the federation released about 4,000 real BTC. SideSwap's peg-out authorization key was never compromised, which is the uncomfortable part: every key behaved correctly and the accounting was still wrong. Blockstream prepared an emergency Elements release, and 3,400 BTC came back on 7 September, leaving roughly 598.5 BTC outstanding.
3. Today's Headlines
Visa reports a sharp rise in stablecoin settlement
Visa said its stablecoin settlement volume passed a $20 billion annualised run rate, more than fifteen times higher than a year earlier, with over 160 stablecoin-linked card programmes live. An annualised run rate projects current activity across a full year. It is not an amount already settled in 2026.
The Bundesbank tests an open-sourced permissioning engine
ZKsync developer Matter Labs open-sourced the permissioning engine of Prividium, its platform for financial institutions, with Germany's central bank the first to run it in its own infrastructure. Chief executive Alex Gluchowski said regulated institutions would not accept a single-vendor dependency in critical infrastructure. Administration tools remain commercial.
California's meme coin bill sits with the governor
AB 2409 would bar public officials from issuing meme coins and stop exchanges listing coins featuring officials to California residents from 1 January 2027. It passed the Senate 40 to 0 and the Assembly concurred 78 to 0, and the legislature's record shows it was presented to the governor on 3 September. It is not yet law.
4. Security Note: a paused asset is not a discount
When exchanges suspend deposits and withdrawals for a token during an active incident, as they did for LBTC this week, the quoted price stops meaning what it usually means. You cannot move the asset, so you cannot arbitrage a gap between the token and the thing it represents, and a cheap price may simply reflect a real chance of loss. The rule during a halt is to do nothing new: do not buy the paused asset, do not add to it, and wait for the operator to confirm reserves are restored.
5. From the Academy Library
Our guide to the Bitcoin ecosystem, Lightning, Ordinals, Runes and Layer 2s explains what sidechains add and what they assume. For the cryptography behind range proofs, read zero-knowledge proofs, or start at Academy School.
Bottom line: The federation's keys worked exactly as designed. The bug was in what the software agreed to believe, which is the harder failure to audit.
Sources and further reading
- Binance: BTC daily closing prices
- Binance: ETH daily closing prices
- Alternative.me: Crypto Fear and Greed Index history
- The Motley Fool: CME FedWatch rate expectations on 8 September
- Federal Reserve: 2026 FOMC meeting calendar
- Blockstream: Liquid security incident status page
- The Block: Liquid Network pauses after peg-out
- The Block: Visa stablecoin settlement run rate
- Ledger Insights: Matter Labs open-sources Prividium as the Bundesbank tests it
- California Legislature: AB 2409 bill status
Disclaimer: This publication is for education and information only. It is not financial, investment, legal, tax, or security advice.