Liquid Network Restarts Block Production After 3,996 BTC Drain

Blockstream's Liquid Network has restarted block production as of September 10, following a September 6 exploit that drained about 3,996 BTC from the Liquid Federation's reserve wallet. At the time, the stolen amount was valued at roughly $320 million. While the chain is producing blocks again, user transactions and peg operations—the mechanism used to move BTC into and out of Liquid—remain paused as recovery efforts continue. The incident traces back to Liquid block 4,050,336, where an attacker exploited a vulnerability in the Elements software that powers the sidechain. The flaw enabled the creation of about 4,000 unbacked LBTC tokens, which are intended to be backed one-to-one by Bitcoin held in the federation's reserve. Those unbacked tokens were then used to drain the reserve. Before the exploit, the federation held more than 4,200 BTC. Afterward, the wallet balance fell to roughly 197 BTC, a drawdown of about 95% in a single event. On September 7, the attackers—or parties claiming to be white-hat hackers—returned around 3,400 BTC. They retained 598.5 BTC, describing it as a bounty for disclosing the vulnerability. Blockstream deployed emergency updates, including Elements v23.3.4, to patch the issue and resumed block production in what it has described as a controlled mode. CEO Adam Back said the one-to-one peg between LBTC and BTC will be maintained and added that no federation authorization keys were compromised, characterizing the breach as a software-level exploit rather than a signing key compromise. With peg operations still suspended, LBTC holders cannot currently redeem for BTC and new deposits are not being accepted. The episode also renews scrutiny of Liquid's federated design. Unlike trustless Layer 2 systems such as Lightning, Liquid relies on a federation of roughly 60 members to custody funds and produce blocks. Although the vulnerability was in the open-source Elements software rather than the federation's custody keys, the outcome was the same: nearly all BTC backing the sidechain disappeared in a single transaction. The return of 3,400 BTC helped limit the risk of a broader confidence shock, but the federation remains short 598.5 BTC versus its pre-incident holdings, leaving users in limbo until peg operations resume.