Liquid Network Restarts Block Production After $320M Exploit

Liquid Network has restarted block generation after a four-day technical suspension triggered by a security incident estimated at $320 million. In a status update posted Sept. 10, 2026 (10:00 UTC), the federation said the sidechain has moved into a controlled resumption phase. Block production resumed at 12:26 UTC once federated nodes completed upgrades, with validators currently signing empty blocks as stability is monitored. Deposits, withdrawals and conversion features remain disabled, and end-user commercial activity has not yet been reopened. The breach was detected on Sept. 6, 2026 at block 4,050,336. A vulnerability in the open-source Elements codebase allowed an attacker to mint nearly 4,000 Liquid Bitcoin (LBTC) without collateral and execute a withdrawal of 3,996 BTC. The synthetic LBTC was routed via the SideSwap exchange service using a pegout authorization key (PAK). Federation nodes approved the transaction because the defect sat at the pre-transaction validation layer. During the exploit, operating reserves held in the federated multisig wallet fell from 4,205 BTC to 197 BTC within minutes. Technical reports said none of the private keys of the 15 federation members were compromised. Other issued assets on Liquid, including Tether (USDT) and various real-world asset (RWA) tokens, were not affected during the halt. SideSwap published a postmortem on Sept. 9, 2026, citing operational lapses. The platform said it kept the PAK key internet-connected and lacked automated velocity controls or per-wallet volume limits. The attacker returned 3,400 BTC to the multisig address on Sept. 7, 2026, describing themselves as a security researcher through on-chain messages. As of now, 598.5 BTC valued at about $47 million remains unrecovered. The attacker has requested a 10% bounty payment to return the remaining funds; Blockstream has not characterized the request as part of an authorized bug bounty program. The federation deployed an emergency patch, Elements v23.3.4, on Sept. 9, 2026. The fix addressed cache key management within range proofs following joint audits with security specialists including Bitcoin Red Team and Alpen Labs. Blockstream CEO Adam Back said the LBTC-to-BTC 1:1 peg will be fully covered, a commitment analysts say could help limit panic selling across OTC desks. According to the federation's recovery plan, reopening will proceed in three phases: controlled block production first, then re-execution of verified legitimate transactions, followed by re-enabling pegs once reserves are fully secured. The next step is expected to include a comprehensive technical audit and the completion of stress testing before liquidity bridges are fully reopened.