Liquid Network resumes after $320M BTC exploit

TLDR

Liquid Network, a Bitcoin sidechain run by Blockstream, has restarted block production after a roughly 320 million dollar exploit drained about 4,000 BTC from its reserves.

1. The exploit used a software bug to mint unbacked L BTC and peg out around 4,000 BTC, of which about 3,400 BTC has been returned.
2. Blocks are now being produced again, but user transactions and BTC peg operations remain paused, so L BTC holders still cannot redeem back to Bitcoin.
3. The incident highlights structural risks in federated Bitcoin sidechains, making it important to watch security upgrades, peg resumption timing, and how the remaining roughly 600 BTC shortfall is resolved.

Deep Dive

1. Exploit Mechanics And Scale

Reports say attackers withdrew about 4,000 BTC, worth roughly 320 million dollars, from Liquids federation wallet on September 6 by exploiting a bug in the Elements software that underpins the network, allowing them to mint L BTC that was not properly backed and then peg out to real BTC via SideSwaps authorized service. Cointelegraph and other outlets describe this as a cache vulnerability in proof verification, later fixed in an emergency Elements v23.3.4 update that hardened range proof cache keys and closed the exploit path.

After Blockstream confirmed patched bridge and functionary nodes, the actors returned around 3,400 BTC, about 270 million dollars, but roughly 598 BTC, near 46 million dollars, remains outstanding and is being treated by the attackers as a de facto bounty demand rather than clearly defined compensation.

2. What Resuming Means For Users

Liquid has resumed block production, with functionary nodes again signing and validating blocks after software updates, but it is doing so without transactions as a precaution while monitoring for full stabilization and reserve restoration. Peg operations, including PAK authorized peg outs, remain suspended, so L BTC holders cannot currently redeem for native BTC, and several venues have reportedly halted L BTC deposits and withdrawals, effectively trapping liquidity until the peg is reopened.

Blockstreams leadership has pledged that all L BTC will be honored 1 to 1 against BTC, aiming to reassure users that their balances will be made whole even though public details on how they will cover the roughly 600 BTC gap are limited for now.

3. Sidechain Risks And Signals To Watch

This exploit did not involve stolen federation signing keys, but rather a failure in software validation that allowed unbacked assets to pass checks, underscoring that federated Bitcoin sidechains and bridges can fail at the code level even when multisig custody looks intact. Researchers have already pointed to mitigations such as mandatory time delay locks on large peg outs, which would give operators hours or days to spot anomalies before BTC actually moves, as advocated in post incident bridge security commentary.

From a risk perspective, the key signals now are adoption of hardened Elements releases, any move toward delayed or more conservative peg rules, the formal resolution of negotiations with the attackers over the remaining BTC, and the moment when Liquid fully resumes transactions and peg operations without further incidents.

Conclusion

Liquid Networks restart of block production is a technical milestone, but the real test is restoring safe peg operations and user liquidity after a 320 million dollar exploit that exposed deep sidechain vulnerabilities. Until the reserves, software fixes, and remaining BTC are fully resolved, Bitcoin holders and sidechain users should treat this as a live case study in cross chain risk rather than a closed chapter.