TLDR
Liquid Network, a Bitcoin sidechain from Blockstream, has restarted block production after an exploit drained about 4,000 BTC from its reserves.
- Block production has resumed, but user transactions and peg-in/peg-out operations remain suspended while stability and full 1:1 L-BTC backing are verified.
- A bug in the Elements software let attackers mint unbacked L-BTC and withdraw nearly 4,000 BTC; about 3,400 BTC were returned, with roughly 600 BTC still missing.
- Blockstream has pledged to make L-BTC whole, but the incident exposes significant operational risk in federated sidechains and makes Liquids restart plan and patching process critical to watch.
Deep Dive
1. What Has Actually Resumed
Reports indicate that Liquid has entered a controlled resumption phase where block production has restarted, but user-facing activity is still heavily constrained. According to a detailed summary, the sidechain is producing blocks again, but transactions and peg operations are disabled until the network is confirmed stable and fully backed.
The same report notes that the hacker returned 3,400 BTC and is holding almost 600 BTC while demanding a 10 percent bounty, and that Blockstream has pledged to cover all L-BTC 1:1 so holders can eventually redeem to mainchain BTC once peg-outs reopen, although no timeline is given yet. These details are captured in a post describing how Liquid Network resumes block production after 4,000 BTC exploit.
The chain is technically alive again, but as an end user you should treat L-BTC and other Liquid assets as illiquid until an official, detailed restart and peg-in/peg-out reopening notice is published.
2. How The 4,000 BTC Exploit Worked
Multiple technical writeups describe the incident as a software-level failure in Elements, the codebase that powers Liquid. An attacker exploited a range-proof cache bug to mint roughly 4,000 unbacked L-BTC, then sent them to SideSwap, a peg-out service, which treated them as valid and triggered real BTC withdrawals from Liquids reserves. One analysis notes that reserves dropped from about 4,205 BTC to around 200 BTC in minutes via this path, without any federation private keys being stolen, because the transaction appeared valid to functionary nodes.
A detailed reconstruction explains that the bug involved a cache-key collision in confidential transaction verification, allowing an invalid output to reuse a cached proof and bypass checks, and that the fix had been merged but not deployed when the exploit hit. After Blockstream patched bridge nodes, the attacker returned 3,400 BTC but retained about 598.5 BTC, framed as a self-declared bounty, as outlined in a report on the range-proof cache bug in Elements and a follow-up that 3,400 BTC were returned while 598.5 BTC remain.
The core cryptographic keys held, but delayed patching of known bugs created a window where a single node-level flaw could almost fully drain the sidechains BTC reserves.
3. Impact For Users And The Wider Market
For L-BTC and other Liquid users, the practical impact is that deposits and withdrawals are or were suspended, and some BTC backing is still missing even as Blockstream promises to cover a 1:1 peg. That means recovery depends both on the hacker negotiations and on Blockstreams balance sheet and governance decisions, not only on protocol rules.
For Bitcoin itself, the base layer is unaffected, but the episode reinforces that bridges and sidechains carry separate infrastructure risk. Reports like this overview of the hack and partial recovery frame it alongside a broader rise in bridge and cross-chain exploits, which can slow institutional comfort with Bitcoin-linked platforms even when mainnet is untouched.
Key things to watch are: deployment of the patched Elements release to all functionaries, clear communication on how the 600 BTC shortfall will be handled, and a transparent relaunch plan for peg-in/peg-out and stablecoin transfers on Liquid.
If you rely on sidechains or bridges for Bitcoin liquidity, this incident is a reminder to treat them as separate risk buckets and to monitor not just security design but also operational patch discipline.
Conclusion
Liquids restart of block production marks early progress toward recovery, but with peg operations still halted and around 600 BTC outstanding, the sidechain is not yet back to normal. The exploit was less about broken cryptography and more about operational security, especially slow deployment of critical patches in a federated system. For crypto users and institutions, the key takeaway is that infrastructure around Bitcoin can fail even when Bitcoin itself does not, so risk management needs to account for the specific trust model and governance of each sidechain or bridge.
CoinsKid.Com