Liquid Network Restarts Block Production After $320M Exploit

Liquid Network has restarted block production after a major Bitcoin withdrawal from its federation wallet, but it is still operating in a limited recovery mode. According to a Thursday update posted on X by Liquid_BTC, the network resumed producing blocks “without transactions” while teams monitor the system for “full stabilization.”

Peg operations—including peg-outs authorized via PAK—remain suspended as Liquid works to restore its BTC/L-BTC reserve. The restart comes after emergency software changes to Elements, the open-source platform that underpins Liquid.

Key takeaways

• Liquid resumed block production, but transaction processing and peg-outs are still paused during recovery.
• Liquid says functionary and bridge node updates have been deployed, with functionary nodes now signing and validating blocks.
• Peg operations remain halted until the network can rebuild its BTC/L-BTC reserve.
• The incident was tied to a vulnerability involving proof verification cache handling in Elements, addressed by an emergency update.

Block production returns—transactions stay paused

Liquid’s latest status update emphasizes caution. In the X post, Liquid states that block production has resumed as a precautionary measure, but “without transactions.” The network is being monitored to confirm that it has fully stabilized before broader functionality is restored.

Alongside the operational restart, Liquid says required upgrades to critical infrastructure nodes have already been pushed. Functionary nodes are now signing and validating blocks “as intended,” which suggests that core consensus duties are functioning again—even though user-facing activity is still constrained.

For participants, this distinction matters. Restarting block production can help ensure the system remains synchronized and responsive, but pausing transactions and peg operations reduces the risk of further complications while the reserve and related state are repaired.

Elements emergency update addressed a proof-verification cache issue

A day before the block production restart, Liquid issued an emergency update to Elements, the software underlying the network. In an earlier X update from Liquid_BTC, the organization described the fix as a response to a vulnerability involving proof-verification cache handling tied to the incident.

Liquid’s recovery plan includes hardening cache keys used for range proofs as part of the software update. The post states the new release is Elements v23.3.4, designed to strengthen how the system verifies proofs during recovery-related operations.

From an investor and builder standpoint, the key takeaway is that Liquid is not just “restarting”—it is changing the underlying mechanics that were implicated in the exploit pathway. That generally reduces the likelihood of a repeat incident once peg functions and transaction handling return.

What happened to the federation wallet balance

The operational pause was triggered on Sept. 6 after actors described as “white-hat hackers” withdrew approximately 4,000 BTC—valued around $320 million at the time—from Liquid’s federation wallet, according to earlier coverage from Cointelegraph.

Liquid previously indicated that the withdrawal involved L-BTC originating from a bug in Elements. The withdrawing portion represented about 95% of the federation wallet’s balance, which was roughly 4,200 BTC.

Subsequently, Cointelegraph reported that 3,400 BTC—worth about $270 million at the time—was returned after Blockstream confirmed that affected bridge nodes had been patched. Even with the return, 598 BTC—roughly $46 million at current prices—remained outstanding as of Sept. 7.

Liquid’s current emphasis on rebuilding its BTC/L-BTC reserve aligns with that earlier balance reality: peg operations are effectively the bridge between the reserve and minted/burned representations. Until the reserve is restored to safe levels and the system’s node components are verified to be operating correctly, resuming peg-outs would create avoidable settlement and redemption risk.

Why the “no transactions” restart is a meaningful step

The move to resume block production—while still withholding transactions—signals that Liquid believes its recovery controls are working, but that it is not yet comfortable restoring normal user workflows. In practice, it lets the network keep progressing at the protocol level, while limiting the number of moving pieces that could interact with remaining reserve and peg-state uncertainty.

As Liquid continues monitoring, the next practical question for market participants is whether peg operations will resume once reserve restoration is confirmed and node updates have been validated under real operating conditions.

Readers should watch Liquid’s follow-up status updates for any change in peg-out authorization and for confirmation that transaction processing can safely return—especially after the Elements v23.3.4 fix and the earlier bridge-node patching are fully validated against the incident’s root cause.