Liquid Network restarts blocks after $320M Elements exploit

The Liquid Network restarted block production on Thursday after emergency software updates were deployed, but transactions and peg operations remain paused following the roughly $320 million exploit that hit the Bitcoin sidechain on Sept. 6.

About 4,000 BTC, worth roughly $320 million, was withdrawn from the federation wallet by actors claiming to be white-hat hackers. The withdrawal represented about 95% of the wallet's 4,200 BTC balance. The funds consisted of L-BTC, Liquid's pegged representation of bitcoin on the sidechain, and the exploit traced back to a bug in Elements, the open-source software underpinning the network.

In a Thursday post on X, Liquid said block production had resumed "without transactions" as a precaution while operators monitor the network to "confirm full stabilization." Functionary nodes, the federation members that sign and validate blocks on Liquid, are now signing and validating blocks as intended after the required updates were deployed to functionary and bridge nodes.

How the Elements bug was exploited

The withdrawn L-BTC originated from a flaw in Elements, and Liquid released an emergency update to Elements a day earlier to address the proof-verification cache vulnerability tied to the incident. The patch, Elements v23.3.4, hardened cache keys used for range proofs, the cryptographic check that confirms confidential transaction amounts are non-negative, as part of the network's recovery plan.

The actors subsequently returned 3,400 BTC, worth about $270 million at the time, after Blockstream confirmed that affected bridge nodes had been patched. Bridge nodes are the operators that connect Bitcoin to Liquid and handle peg-ins and peg-outs. About 598 BTC, worth roughly $46 million at current prices, remained outstanding as of Sept. 7.

What is still paused, and what remains unclear

Peg operations, including PAK-authorized peg-outs, withdrawals of L-BTC back into native BTC that require Physical Asset Key approval, remain suspended while the network works to restore its BTC/L-BTC reserve, the conversion between Bitcoin and its Liquid pegged form.

Liquid has not said which members of its federation were compromised in the original withdrawal, and whether the outstanding 598 BTC is frozen, in motion, or being negotiated has not been publicly disclosed. The cited reporting does not include on-chain transaction hashes, wallet addresses, or block heights for either the 4,000 BTC outflow or the 3,400 BTC return, and the actors behind the withdrawal have not been publicly verified as white-hat hackers by Liquid or Blockstream beyond their own self-description.

Related: Liquid Network Recovers 3,400 BTC From Hackers as $47M Remains Outstanding