Liquid Network, the Bitcoin sidechain operated by Blockstream, resumed producing blocks on Thursday, September 10, four days after an exploit drained roughly 4,000 BTC, about $320 million at the time, from its federation wallet. According to Cointelegraph, the restart came after operators deployed an emergency software update, though the network is deliberately running without user transactions for now.
The drained amount represented close to 95% of the roughly 4,200 BTC held in the federation wallet that backs Liquid Bitcoin (L-BTC). That scale is what forced the network offline in the first place: with almost the entire peg reserve exposed, continuing to process transactions risked compounding the damage.
The bug that emptied the peg
The root cause sits in Elements, the open-source software that underpins Liquid. The exploit targeted a proof-verification cache vulnerability tied to how the software handled range proofs, the cryptographic component that keeps Liquid's confidential transaction amounts valid without revealing them. Attackers were able to abuse that cache to move funds out of the peg on September 6.
The fix is Elements v23.3.4, which Blockstream describes as hardening the cache keys used for range proofs. Functionary nodes, the members of Liquid's federation that sign and validate blocks, were redeployed running the patched software before block production restarted.
That federation model is central to understanding both the failure and the response. Liquid is not a trustless chain in the way Bitcoin's base layer is. A defined set of functionaries jointly custody the BTC reserve and authorize peg-outs. That design allows faster settlement and confidential transfers, but it also concentrates the assets in a way that a single software bug can put at risk. For anyone weighing where they hold value, it is a reminder that assets bridged onto a second layer carry the security assumptions of that layer, not of Bitcoin itself. Holding coins in your own self-custody wallet on the base chain avoids the federation as a point of failure, at the cost of the speed and privacy features Liquid was built to provide.
Blocks moving, funds still parked
The restart is narrower than it sounds. Liquid resumed block production "without transactions" as a precaution, meaning functionaries are signing and validating empty blocks to prove the patched software behaves as intended before real value flows again. User transactions remain suspended. Peg operations, including PAK-authorized peg-outs, are also still frozen while the network is monitored to confirm full stabilization.
In practice, that means L-BTC holders cannot yet move funds or redeem back to Bitcoin on-chain. The chain is technically alive again, but closed to activity. Blockstream has framed the empty-block phase as a checkpoint rather than a full recovery.
The clawback is most of the way there
The counterweight to the loss has been an unusually large white-hat return. After Blockstream confirmed that the affected bridge nodes had been patched, white-hat actors sent back 3,400 BTC, roughly $270 million. That leaves an outstanding balance of about 598 BTC, near $46 million, based on figures as of September 7.
Returning more than four-fifths of a nine-figure haul is rare in incidents of this size, and it materially changes the outlook for the peg. Whether the remaining balance comes back, gets covered, or becomes a permanent shortfall against L-BTC in circulation is the open question that will decide how cleanly Liquid reopens.
Next checkpoints to watch
The sequence from here is straightforward to track. Empty blocks need to run without incident, then transactions get re-enabled, then peg-ins and peg-outs resume so holders can redeem. Each step is a separate go or no-go decision by the federation, not a single switch.
The recovery has moved quickly relative to the severity: a same-week patch, functionaries back online, and most of the funds returned inside days. But block production restarting is not the same as the network being open, and the roughly $46 million still outstanding is the figure that determines whether L-BTC remains fully backed once peg operations turn back on.
Overview
Liquid Network restarted block production on September 10 after a September 6 exploit drained about 4,000 BTC ($320M), close to 95% of its federation reserve, through a range-proof cache bug in Elements. Operators deployed Elements v23.3.4 and brought patched functionaries back online, but transactions and peg operations stay suspended pending confirmation of stability. White-hats have returned 3,400 BTC ($270M), leaving roughly 598 BTC (~$46M) outstanding. The chain is producing empty blocks as a test phase, not yet open to users.
