TLDR
- Liquid Network restarted block production but kept transactions and peg operations suspended
- About 4,000 Bitcoin worth $320M was withdrawn by actors claiming to be white-hat hackers
- 3,400 BTC worth roughly $270M was returned after Blockstream confirmed nodes were patched
- Around 598 BTC worth about $46M remains outstanding with no confirmed return plan
- Emergency software update Elements v23.3.4 fixed the proof-verification cache flaw that caused the exploit
Liquid Network has resumed producing blocks on its Bitcoin sidechain, but transactions and peg services remain offline following a $320 million Bitcoin withdrawal that exposed a flaw in its core software.
LIQUID NETWORK UPDATE: OPERATIONS RESUMED, RECOVERY ONGOING
Status as of September 10, 2026, 10:00 UTCRecovery Status
The Liquid Network has entered the next phase of its controlled resumption. As a precautionary measure, block production has resumed without transactions while… https://t.co/PbyBXIzdQc
— Liquid Network 🌊 (@Liquid_BTC) September 10, 2026
What Happened
On September 6, actors claiming to be white-hat hackers withdrew around 4,000 Bitcoin from Liquid’s federation wallet. That represented roughly 95% of the wallet’s total balance at the time.
The withdrawal was made possible by a bug in Elements, the open-source software that powers Liquid. The bug sat in the proof-verification cache, which is a system that stores results from checking confidential transaction proofs so nodes do not have to repeat calculations.
The flaw meant a valid proof result could be reused where it should have failed. This let the actor create L-BTC, Liquid’s pegged token, without locking an equal amount of real Bitcoin in the federation wallet first.
The actor then submitted the unbacked L-BTC through SideSwap’s authorized peg-out service. The service processed the request normally, and the federation released roughly 3,996 real Bitcoin, draining the wallet from about 4,205 BTC down to around 202 BTC.
No federation signing key was stolen. The failure was in the software used to decide whether the L-BTC being redeemed was valid.
Recovery Progress
Blockstream and the actors communicated through messages embedded in Bitcoin transactions. The actors said they would return the funds after nodes were patched.
After Blockstream confirmed its bridge nodes had been fixed, the actors returned 3,400 BTC, worth around $270 million at the time. That restored about 85% of the withdrawn funds.
Around 598 BTC, worth roughly $46 million, remains in the withdrawal-linked address. No public agreement has confirmed whether this is an approved bounty or when it might be returned.
Ledger’s Chief Technology Officer Charles Guillemet publicly questioned the white-hat label. He said keeping around 600 BTC without disclosed terms looked more like extortion than a standard security reward.
Software Fix and Current Status
Liquid released an emergency update, Elements v23.3.4, one day before restarting block production. The update changes how cache keys are stored when validating range proofs, closing the gap the actor exploited.
Functionary and bridge nodes received the update before block signing restarted. Liquid’s federation uses 15 rotating functionaries and requires 11 signatures to move funds.
Block production is now active but running without transactions. Liquid said keeping transfers disabled will help confirm the deployment is stable before other services come back online.
Peg operations, including PAK-authorized withdrawals, remain suspended. Liquid has not given a date for restoring transactions or bridge services.
L-BTC holders currently cannot redeem their tokens for native Bitcoin through the normal process. No U.S. regulator has announced any action related to the incident.
