The Liquid Network restarted block production on Thursday after a major withdrawal of approximately 4,000 Bitcoin, valued at around $320 million, forced a halt earlier in the week. Functionary nodes are again signing and validating blocks following emergency software updates, though the network is running without transactions while operators monitor for full stabilization.

Peg operations, including withdrawals authorized through Peg-out Authorization Keys, remain suspended as the network works to restore the Bitcoin reserve that backs Liquid Bitcoin, or L-BTC.

Limited Restart After Emergency Patch

Liquid confirmed that required updates to functionary and bridge nodes have been deployed. The nodes can now perform their core consensus duties as intended. The decision to keep regular transactions disabled allows teams to test the updated infrastructure without reopening transfers or exposing the peg system to new activity.

One day before the restart, Liquid released Elements version 23.3.4, an emergency update to the open-source software that powers the sidechain. The patch changes how the software verifies and stores confidential transaction proofs, specifically hardening cache keys used for range proofs. The earlier cache design had allowed a valid proof result to be reused in contexts where it should have failed, enabling the creation of unbacked L-BTC.

No federation signing key was reported stolen. The failure centered on the software used to determine whether submitted L-BTC was valid for redemption.

Details of the September 6 Withdrawal

Operations paused on September 6 after actors identifying themselves as white-hat hackers withdrew roughly 4,000 BTC from the federation wallet. The amount represented about 95 percent of the wallet’s approximate 4,200 BTC balance at the time. The tokens originated from the Elements vulnerability and were processed through SideSwap’s authorized peg-out service under normal procedures. SideSwap and Liquid stated that the authorization key itself had not been compromised.

Under normal conditions, users deposit Bitcoin into the federation-controlled peg and receive an equal amount of L-BTC. Holders later burn L-BTC through an approved service to release the corresponding Bitcoin on the base layer. That process stopped after the unbacked tokens were redeemed for real Bitcoin.

After Blockstream confirmed that bridge nodes had been patched and the Bitcoin was safe to return, the actors transferred 3,400 BTC back to the federation wallet. The repayment restored about 85 percent of the withdrawn funds and was valued at approximately $270 million at the time of transfer.

Approximately 598.5 BTC, worth roughly $46 million to $47 million depending on market prices, remained outstanding. No public agreement has identified the remaining balance as an approved security bounty.

Ledger Chief Technology Officer Charles Guillemet questioned the white-hat characterization after the partial repayment, arguing that retaining about 600 BTC without publicly disclosed terms resembled extortion more than a standard security reward.

Peg Services and User Impact

Liquid operates as a federated Bitcoin sidechain launched by Blockstream in 2018. It enables exchanges, trading firms and other users to transfer BTC-linked assets with shorter settlement times and confidential transactions. L-BTC depends on Bitcoin held in the federation wallet to maintain one-to-one backing. Until peg operations resume, holders cannot use the normal bridge process to redeem L-BTC for native Bitcoin.

Blockstream CEO Adam Back has stated that the L-BTC peg will be maintained on a one-to-one basis once normal operations return. He advised users against panic selling over the counter while the network stabilizes. No timetable has been provided for restoring transactions, PAK-authorized peg-outs or other bridge functions.

The federation relies on 15 rotating functionaries and requires 11 signatures to move funds from its multisignature wallet. Liquid continues monitoring the network after the Elements update and the return of the majority of the withdrawn Bitcoin.