Liquid Network has kept redemptions of its LBTC token for bitcoin suspended for 35 days following a software exploit that released nearly 4,000 BTC from the protocol’s reserves. As of October 11, 2026, the network’s backing stands at approximately 86%, with an estimated shortfall of about 600 BTC, while the attacker continues to hold 598.5 BTC valued at roughly $49.69 million.

Exploit Details and Partial Recovery

The incident occurred on September 6, 2026, when a vulnerability in the Elements software allowed the creation of invalid LBTC that passed validation checks. This led to the release of approximately 3,996 BTC from the Liquid Federation’s reserve onto the Bitcoin network, nearly all of which was sent to an address controlled by the exploiter. The issue involved a proof-verification cache flaw rather than the compromise of private signing keys.

On September 7, the self-described white-hat attackers returned about 3,400 BTC. Roughly 598.5 BTC, or about 15% of the total withdrawn, remained in the attacker’s wallet. Blockstream, the creator of Liquid, rejected the attackers’ demand for a 10% bounty and called for the immediate return of the remaining bitcoin. That demand has not been met, leaving the shortfall unresolved more than a month later.

Ongoing Freeze and Security Measures

Liquid requires complete one-to-one bitcoin backing for outstanding LBTC, along with finished security reviews, before peg-out operations can restart. An independent external security audit of Elements version 23.3.4 remains underway. In parallel, the Liquid Federation is updating its Peg-out Authorization Key list, replacing existing entries, and moving all peg-out keys into cold storage.

Block production and ordinary user transactions resumed on September 10 after the release of Elements v23.3.4 on September 9, which addressed the cache vulnerability. However, the peg-out service that burns LBTC and releases equivalent bitcoin from reserves has stayed disabled. Liquid has not announced a date for restoration.

User Response and Market Impact

The prolonged suspension has drawn criticism from users. One longtime supporter stated that communications from Blockstream have been sparse and inconsistent, noting that the network sits at 86% backing and that 14% of holders’ assets remain unsupported.

Some LBTC holders have shifted funds through alternative platforms such as Sideswap and Sideshift.ai. One user reported that limited liquidity extended the process over several weeks and that combined spreads and fees reached about 5%, describing the cost as a necessary step for peace of mind.

The attacker’s wallet continues to hold the remaining 598.5 BTC and has attracted repeated address-poisoning attempts along with messages embedded in OP_RETURN transactions. Liquid’s latest public statements frame the audit and key-management work as necessary steps toward the safe resumption of peg-outs, yet the reserve gap and incomplete reviews continue to block any restart.