Liquid Network Resumes Bitcoin (BTC) Block Production After $320M Exploit

Block Production Restored Without Transactions

The Liquid Network has restarted block production, four days after a flaw in its underlying code let attackers pull roughly 4,000 Bitcoin (BTC) — about $320 million — out of the sidechain’s federation wallet, the most serious breach this year across Bitcoin ecosystem infrastructure. In an official announcement on X, the team said blocks are now being produced “without transactions” as a precaution while engineers monitor the chain to confirm full stabilization. Updates for its functionary and bridge nodes have been deployed, and functionary nodes are once again signing and validating blocks as designed.

Peg operations, including PAK-authorized peg-outs, remain frozen while the network works through its final recovery stage: rebuilding the BTC/L-BTC reserve. Holders of assets issued on the chain, stablecoins among them, were left unable to move or control their holdings while operations were suspended.

The episode began on Sept. 6, when actors describing themselves as white-hat hackers extracted close to 4,000 BTC — nearly 95% of the wallet’s approximately 4,200 BTC balance — via a proof-verification cache bug in Elements, the open-source software that underpins Liquid and extends the Bitcoin network beyond its base layer. Once Blockstream confirmed the affected bridge nodes had been patched, the group returned 3,400 BTC, valued near $270 million at the time. Explorer data showed about 598 BTC, roughly $46 million, still outstanding as of Sept. 7. Recovery work also produced an emergency Elements release, v23.3.4, which hardened the cache keys used for range proofs — the cryptographic commitments allowing the sidechain to verify confidential transaction amounts without exposing them.

Hacker’s 10% Bounty Demand

Blockstream chief executive Adam Back has moved to reassure holders of L-BTC — the asset representing BTC on the sidechain, functionally a form of wrapped Bitcoin — that the peg will hold at full value. Back confirmed publicly that users will be able to redeem L-BTC against an equivalent amount of BTC on the base chain once redemption resumes, though he stopped short of explaining how the roughly 600 BTC shortfall will be covered or when services will return. His advice to holders was direct: refrain from panic-selling positions at a discount over the counter while the team completes system updates needed to restart peg-ins and peg-outs.

The group holding the remainder has attached conditions. The self-styled white-hat whale is demanding a 10% bug bounty and has threatened to withhold the residual balance — close to 600 BTC — if it goes unpaid, converting the outstanding coins into a negotiating lever. In a message published on-chain on Sept. 9, the actor attacked Blockstream’s security budget, claiming the company allocated just $1.5 million to safeguard roughly $5 billion in assets secured by the federation, and described the negligence as evident. Blockstream, which has kept the channel open through on-chain messages rather than public statements, maintains that recovery of the outstanding funds is actively in progress. The sidechain, launched in 2018, relies on a federation of functionaries to sign blocks and authorize peg movements — a design now under intense scrutiny.

Peg-Out Resumption Is the Real Test

In COINOTAG’s reading, the restart of block production is necessary but not sufficient. The on-chain record of the hacker’s Sept. 9 message remains publicly verifiable, and so is the unfinished state of the reserve; the load-bearing commitment is Blockstream’s pledge that L-BTC redeems 1:1 — a promise with echoes of recent custodial stress across the sector, from the recent Trezor phishing breach to bridge failures. Traders should watch two confirmations: PAK-authorized peg-outs going live, and an explicit statement that the BTC/L-BTC reserve is whole. Until both land, L-BTC trades on trust in the federation rather than on proof, and the 598 BTC gap keeps the bounty dispute as the swing factor for full recovery.