Liquid Network resumes after $320M BTC exploit

TLDR

Liquid Network, Blockstreams Bitcoin sidechain, has restarted block production and transactions after a roughly 4,000 BTC exploit, but full recovery is still incomplete.

1. Around 4,000 BTC, worth about $320 million, were drained via a software bug that let attackers mint unbacked L-BTC and peg out to real BTC.
2. Liquid has resumed blocks and transactions after deploying a patched Elements release, but peg-outs (BTC withdrawals from Liquid) remain disabled and roughly 600 BTC are still missing.
3. Blockstream has refused the attackers 10 percent bug bounty demand, is treating the incident as theft, and plans to pursue legal and forensic routes, highlighting sidechain risk but leaving Bitcoins main chain unaffected.

Deep Dive

1. Exploit And Scale

Reports from multiple outlets say attackers used a vulnerability in the Elements softwares range proof verification cache to create about 4,000 L-BTC not backed by reserve Bitcoin, then converted these to real BTC via the SideSwap peg-out infrastructure, draining most of Liquids federation wallet reserves, roughly $320 million at the time of the hack.

The attackers later returned about 3,400 BTC, leaving approximately 598.5 BTC outstanding, valued near $47 million, according to detailed coverage by sources such as The Block and CryptoBriefing.

Importantly, Liquids federation signing keys were not reported as compromised; the bug was in validation logic, showing how sidechain designs can fail even without key theft.

2. Network Recovery Status

Blockstream and Liquid operators deployed an emergency Elements update (v23.3.4), then restarted block production and brought transactions back online around September 10, as covered in reports that Liquid Network has resumed block production after the exploit.

Peg-outs remain disabled, meaning users cannot yet move BTC out of Liquid to the main chain; L-BTC is only backed about 85 percent until the missing BTC are recovered or additional BTC is deposited to restore a 1:1 peg.

3. Blockstream Stance And Risks

Blockstream publicly rejected the attackers demand for a 10 percent bounty from its own funds, calling the incident theft rather than white-hat disclosure and warning that paying a ransom would set a damaging precedent for open-source Bitcoin infrastructure.

The company says it will work with law enforcement, exchanges, service providers, and forensic specialists to trace the remaining BTC, stressing that Bitcoins transparent ledger makes long term hiding of stolen funds difficult.

For users, the episode underlines that Bitcoin itself continues to operate normally, but any federated sidechain or custody layer introduces separate attack surfaces and trust assumptions that need scrutiny.

Conclusion

Liquid Networks return to block production and transactions marks a significant step in recovering from one of the largest Bitcoin-linked exploits to date, yet the missing BTC and disabled peg-outs show the recovery is not complete.

For Bitcoin holders, the main chains security model remains unchanged, but the incident is a clear reminder that sidechains and bridging infrastructure carry distinct systemic and operational risks that should be factored into any strategy using them.