Liquid Network Moves to Recover Remaining 598.5 BTC After Exploit

Odaily Planet Daily reported that Liquid Network's latest incident report detailed an exploit disclosed on September 6 involving open-source Elements software. Liquid said a flaw tied to range-proof verification used for Liquid node caching was abused to mint roughly 4,000 LBTC without matching Bitcoin reserves. The attacker then swapped the tokens for about 4,000 BTC through SideSwap and Liquid's standard pegout process. Liquid's reserves were around 4,205 BTC before the incident. After the affected pegouts and other withdrawals cleared before the network was halted, reserves fell as low as 197 BTC. Liquid said no Functionary nodes or private keys were compromised, and other Liquid-issued assets such as USDT were not impacted by the vulnerability. The attacker, describing themselves as a whitehat security researcher, returned 3,400 BTC to the Liquid Federation Peg wallet on September 7. Roughly 598.5 BTC—about 15% of the funds involved—remains outstanding. Blockstream said it is communicating with the individual to recover the remainder. Liquid said its immediate focus is recovering the remaining funds and restoring normal operations as quickly and securely as possible. A fix has been developed and is undergoing multiple rounds of internal and external review. Blockstream is preparing an urgent release of Elements v23.3.4, expected to be published once preparations are complete, with deployment targeted within about 48 hours. Following the update, Liquid Functionary operators will carry out further adjustments to restore full network functionality and return the system to a corrected state, including rejecting previously invalid pegouts.