Liquid Network restarts block production after $320M exploit

The Liquid Network has restarted block production after a major Bitcoin withdrawal tied to a vulnerability in Elements, the open-source software that underpins the sidechain. Liquid said it is bringing the system back in a cautious, staged way—enabling block creation while keeping transaction processing and peg operations paused as it continues recovery and monitoring.

In a Thursday update shared on X, Liquid stated that block production resumed “without transactions” as a safety measure. The network is now being monitored to “confirm full stabilization,” while required updates to its functionary and bridge nodes have been deployed.

Key takeaways

• Liquid resumed block production, but transactions and peg-related activities remain suspended during recovery.
• Liquid says functionary nodes are now signing and validating blocks properly after updates.
• Peg operations, including PAK-authorized peg-outs, are still paused until Liquid restores its BTC/L-BTC reserve.
• An earlier emergency Elements update (v23.3.4) targeted a proof-verification cache weakness linked to the incident.

Block production returns—transactions still offline

Liquid’s latest status update frames the restart as a precaution rather than a full operational return. According to the network, block production is running “without transactions,” meaning the chain can produce blocks while the system avoids handling live transaction traffic until the team is satisfied that everything is functioning as intended.

Liquid also emphasized that it has pushed the necessary changes to its functionary and bridge node infrastructure. It said functionary nodes are now signing and validating blocks as expected, which is a critical capability for the network’s consensus behavior.

For users and builders, the distinction matters. Restarting block generation can help confirm that parts of the network stack are functioning, but suspending transaction processing reduces operational risk and prevents additional complexity during an ongoing stabilization period.

Peg operations remain paused pending reserve restoration

Even with block production back online, Liquid made clear that peg operations are not restarting yet. Peg processes—specifically including PAK-authorized peg-outs—remain suspended while the network works to restore its BTC/L-BTC reserve.

That pause underscores the core issue behind the exploit: the withdrawal affected the network’s ability to honor the peg mechanism safely. Liquid’s next steps therefore hinge not only on software hardening, but also on whether the relevant reserves and linked components are returned to a fully healthy state.

Emergency Elements patch hardened proof verification caches

The resumed activity comes on the heels of an earlier intervention. A day before the restart, Liquid released an emergency update to Elements—version 23.3.4—after the incident was tied to a proof-verification cache vulnerability.

Liquid’s emergency update focused on “hardening cache keys used for range proofs” as part of its recovery plan. In practical terms, range proofs are part of how confidential transaction values can be verified without revealing the underlying amounts. If proof verification behavior can be influenced in unexpected ways due to caching or keying issues, an attacker may find routes to disrupt assumptions about what has been validated.

By addressing cache key handling, Liquid signaled that the recovery plan requires both patching the software layer and verifying that the patched infrastructure behaves correctly across the federation’s node operators.

What happened during the September withdrawal

Liquid paused operations on Sept. 6 after actors claiming to be “white-hat hackers” withdrew about 4,000 BTC—worth roughly $320 million at the time—from the network’s federation wallet. This withdrawal represented about 95% of the wallet’s roughly 4,200 BTC balance.

According to earlier coverage referenced by the Liquid Network’s own updates, the withdrawal involved L-BTC originating from a bug in Elements, the open-source software that underlies Liquid. That linkage is important because it narrows the scope of the underlying cause to a specific layer of the system: the confidential transaction/proof verification components and how they interact with caching and range proof validation.

Following the withdrawal, the actors returned 3,400 BTC—worth about $270 million at the time—after Blockstream confirmed that affected bridge nodes had been patched. Earlier reporting also indicated that 598 BTC (roughly $46 million at current prices) remained outstanding as of Sept. 7.

That sequence—withdrawal, patch confirmation, partial return—helps explain why recovery is taking multiple steps. Even after software changes are deployed and some funds are returned, the peg mechanism can’t safely resume until reserves and operational invariants are fully restored.

Liquid’s current “without transactions” approach appears designed to separate network health verification (block signing/validation) from settlement and peg flows that require complete confidence in reserves and security assumptions.

What to watch next for Liquid users

Liquid has not given a restart timeline for transaction processing or peg-outs, so the immediate watchpoints are whether the network confirms “full stabilization” under live conditions and whether the BTC/L-BTC reserve is restored sufficiently to lift the peg suspension. For anyone using Liquid for token transfers or peg activity, the next operational update on peg resumption will likely be the most consequential signal.