Liquid Network resumes after 4,000 BTC exploit

TLDR

Liquid Network, Blockstreams Bitcoin sidechain, has restarted block production after a roughly 4,000 BTC exploit, but transactions and peg operations are still offline during recovery.

1. A vulnerability in the Elements software let attackers drain about 4,000 BTC, of which roughly 3,400 BTC has been returned and nearly 600 BTC remains missing.
2. Liquid is now producing empty blocks after emergency updates, while BTC/L-BTC peg operations stay suspended and Blockstream pledges to honor L-BTC 1:1 without paying a ransom.
3. The incident highlights structural risks in federated sidechains and cross chain bridges, and the key next signals are the postmortem, peg restart, and how the remaining BTC shortfall is handled.

Deep Dive

1. What Happened In The Exploit

Reports say actors claiming to be white hat hackers exploited a bug in Elements, the software underpinning Liquid, to mint unbacked L BTC and then withdraw about 4,000 BTC, roughly 95 percent of the federations 4,200 BTC reserves, worth around 320 million dollars. Cointelegraph details that after bridge nodes were patched, the attackers returned about 3,400 BTC, leaving around 598 BTC still outstanding, valued near 46 million dollars at the time. Media coverage describes this as one of the largest crypto hacks of 2026, with Liquid pausing operations while the flaw was fixed and reserves assessed.

2. How Liquid Is Resuming And Blockstreams Response

Liquid has resumed block production without transactions, meaning functionary nodes are signing and validating blocks but ordinary transfers and peg in or peg out operations remain disabled as stability is monitored. An emergency update, Elements v23.3.4, hardened proof verification cache keys to prevent reuse of range proof validations that enabled the exploit, according to network recovery reports such as this analysis. Blockstream and Liquid have stated that L BTC will be honored 1:1 against BTC, and Blockstream has publicly refused to pay the attackers requested 10 percent bounty from its own funds, characterizing the demand as theft rather than responsible disclosure in statements summarized by outlets like U.Today.

3. Risks For Users And What To Watch

For now, Liquid users cannot redeem L BTC for native BTC or move other assets on the sidechain until peg operations and transactions are restored, so liquidity is constrained and any OTC trading of claims depends heavily on trust in Blockstreams make whole pledge. Security focused commentators have also raised concerns about how quickly the bug was addressed and whether prior warnings were heeded, underscoring the reliance on a relatively small federation and complex software for custodial safety on sidechains.

Conclusion

Liquids controlled resumption of block production shows the core infrastructure has been patched enough to run again, but the continued freeze on transactions and pegs signals that the fallout from the 4,000 BTC exploit is not yet fully resolved. For crypto users, the episode is a reminder that even Bitcoin related sidechains carry bridge and custodial risk, and that recovery hinges less on code alone than on how operators handle shortfalls, disclosures, and user protection in the weeks ahead.