Liquid Network resumes blocks after $320M Bitcoin withdrawal

Liquid Network has resumed block production without processing transactions after a $320 million Bitcoin withdrawal forced the sidechain to halt operations.

Liquid Network said in a Thursday update that its functionary nodes were again producing blocks as intended, but the network would operate “without transactions” while developers monitored its condition.

The limited restart allows Liquid to test its updated infrastructure without reopening transfers or exposing the peg system to new activity. According to the network, keeping transactions disabled will help operators “confirm full stabilization” before they restore other services.

Functionary and bridge nodes have received the required software changes, Liquid added. Its functionaries can now sign and validate blocks, though users cannot yet send regular transactions or move funds between Bitcoin and Liquid.

Peg operations also remain suspended, including withdrawals approved through Peg-out Authorization Keys, or PAKs. Liquid said the restrictions would stay in place while it works to restore the reserve that supports Bitcoin issued on the sidechain as L-BTC.

Liquid Network has restarted with transactions disabled

Block production represents only one part of Liquid’s return to service because its transaction and bridge systems remain unavailable. The network has not provided a date for reopening either function.

Under normal conditions, users deposit BTC into the federation-controlled peg and receive an equal amount of L-BTC for use on Liquid. Holders can later burn L-BTC through an approved peg-out service to release the corresponding Bitcoin on the base layer.

Operators stopped that process after an actor created unbacked L-BTC by exploiting a proof-verification flaw in Elements, the open-source software behind Liquid. The actor then submitted the tokens through SideSwap’s authorized peg-out service, prompting the federation to release real Bitcoin.

As crypto.news previously reported, the transaction removed about 3,996 BTC and reduced the federation wallet from approximately 4,205 BTC to about 202 BTC. The withdrawal represented roughly 95% of the Bitcoin held in the wallet at the time.

Liquid described the actors as “purported white-hat hackers” after they identified themselves as white hats through messages attached to Bitcoin transactions. Their claim did not establish that they had permission to create the L-BTC or withdraw the underlying Bitcoin.

SideSwap said a customer had sent 4,000 L-BTC to its peg-out service, which processed the request under its normal system. Liquid and SideSwap said the key used to authorize the transaction had not been compromised.

Elements update changes proof-verification cache

One day before restarting block production, Liquid released an emergency Elements update designed to address the flaw connected to the withdrawal.

Elements v23.3.4 changes the cache keys used when validating range proofs, according to Liquid. Range proofs allow the network to confirm that a hidden transaction amount is valid without publicly revealing the amount, forming part of Liquid’s confidential transaction system.

The affected software stored successful proof-verification results so nodes could reuse them instead of repeating the full calculation. Previous reporting found that the cache did not include enough transaction context, allowing a valid proof result to be reused where it should have failed.

By exploiting that weakness, the actor created L-BTC without first locking an equal amount of Bitcoin in the federation wallet. Functionary nodes running the affected code accepted the tokens, while SideSwap’s peg-out process treated them as valid L-BTC and processed the withdrawal.

Liquid said version 23.3.4 hardens the cache keys associated with range proofs. Functionary and bridge nodes received the update before block signing restarted, although the network is still withholding transactions while operators check the deployment.

Liquid’s federation uses functionary nodes to confirm sidechain blocks and control the Bitcoin held behind L-BTC. The system relies on 15 rotating functionaries and requires 11 signatures to move funds from its multisignature wallet, according to an earlier technical account of the incident.

No federation signing key was reported stolen during the withdrawal. The failure instead involved the software used to decide whether the L-BTC submitted for redemption was valid.

Hackers returned 3,400 BTC after nodes were patched

Communication between Blockstream and the actors took place through messages embedded in Bitcoin transactions. In one message, the actors said they would return the assets after the vulnerable nodes had been repaired.

“Please fix the bug first,” the message said. “Make sure every node is patched. Then we will transfer the money back safely after confirming the fix.”

Blockstream later sent a signed message stating that its bridge nodes had been patched and that the Bitcoin was “safe to return.” Following that confirmation, the actors transferred 3,400 BTC back to the federation wallet.

The 3,400 BTC repayment restored about 85% of the withdrawn funds. At the time of the transfer, the returned Bitcoin was worth approximately $270 million.

About 598.5 BTC remained in the withdrawal-linked address after the repayment. The outstanding balance was worth roughly $46 million based on the Bitcoin price cited in the supplied report, though its dollar value changes with the market.

No public agreement has identified the remaining Bitcoin as an approved security bounty. The actors have not publicly stated whether they plan to return another portion, while Blockstream has not announced terms allowing them to keep the balance.

Ledger Chief Technology Officer Charles Guillemet questioned the white-hat label after the partial repayment. In an X post, he argued that retaining about 600 BTC without publicly disclosed terms looked more like extortion than a standard security reward.

L-BTC holders await restoration of peg services

Liquid operates as a federated Bitcoin sidechain that allows exchanges, trading firms and other users to transfer BTC-linked assets with shorter settlement times than Bitcoin’s base layer. Blockstream launched the production network in 2018 using Elements software.

L-BTC depends on Bitcoin held in the federation wallet to maintain its one-to-one backing. Until Liquid restores peg operations, holders cannot use the normal bridge process to redeem L-BTC for native Bitcoin.

A previous bridge security explainer described how systems that lock assets on one chain and issue linked tokens on another depend on their custody, validation, and message-processing controls. A failure in any part of that process can suspend redemptions even when the underlying blockchain continues to operate.

For U.S. users, the current effect is limited to access and operations rather than a stated change in federal policy. American L-BTC holders face the same transaction and peg restrictions as users elsewhere, while BTC held directly on Bitcoin’s base layer remains separate from the Liquid system.

No U.S. regulator or law enforcement agency has announced an action connected to the withdrawal. Liquid also has not given a timetable for restoring transactions, PAK-authorized peg-outs, or other bridge operations.