57 minutes ago
10
The Liquid Network, Blockstream’s flagship Bitcoin sidechain, restarted block production on September 10 after an exploit four days earlier drained roughly 3,996 BTC from the federation’s reserve wallet. At the time of the breach, that haul was worth approximately $320 million.
The network is technically alive again, but user transactions and peg operations, the mechanism that lets people move BTC in and out of the sidechain, remain suspended while recovery work continues.
What actually happened
On September 6, at Liquid block 4,050,336, an attacker exploited a vulnerability in the Elements software that underpins the network. The bug allowed the creation of approximately 4,000 unbacked L-BTC tokens, which are supposed to be backed one-to-one by actual Bitcoin held in the federation’s reserve wallet.
Those unbacked tokens were then used to drain the reserve. Before the exploit, the Liquid Federation held over 4,200 BTC. Afterward, the wallet contained roughly 197 BTC. That is a 95% drawdown in a single incident.
The next day, September 7, the attackers, or at least entities claiming to be white-hat hackers, returned approximately 3,400 BTC to the federation. They kept 598.5 BTC for themselves, framing it as a bounty for exposing the vulnerability.
Emergency patches and controlled restart
Blockstream’s team deployed emergency software updates, including Elements v23.3.4, to patch the vulnerability that enabled the exploit. Block production resumed on September 10, though the network is operating in what has been described as a controlled mode.
Adam Back, Blockstream’s CEO, stated that the one-to-one peg between L-BTC and BTC would be maintained. He also confirmed that no federation authorization keys were compromised during the incident, meaning the breach was a software-level exploit rather than a compromise of the federation’s signing infrastructure.
Still, the fact that user transactions and peg operations remain paused introduces real friction. Anyone holding L-BTC right now cannot redeem it for actual Bitcoin, and no new deposits can be made.
The federated model under the microscope
Liquid has always occupied an interesting position in the Bitcoin ecosystem. It is not a trustless Layer 2 solution like the Lightning Network. Instead, it relies on a federation of roughly 60 members to custody funds and produce blocks.
The vulnerability was not in the federated custody model itself, since the keys were not compromised. It was in the open-source Elements software that powers the chain. But the practical outcome was the same: nearly all the Bitcoin backing the sidechain vanished in a single transaction.
The rapid return of 3,400 BTC by the purported white-hat hackers prevented what could have been a catastrophic loss of confidence. Even so, the federation is still short 598.5 BTC compared to where it started, and users are stuck in limbo until peg operations resume.
Disclosure: This article was edited by Editorial Team. For more information on how we create and review content, see our Editorial Policy.
English (US) ·