Liquid Network Reboots After the 320 Million USD Bitcoin Heist That Wasn’t — Blocks Flow Again, but Your Funds Are Still Locked Out

The Liquid Network, the Bitcoin sidechain rocked by a 320 million USD withdrawal last week, has resumed block production — but transactions and peg operations remain suspended while engineers verify the network is fully stable.

By Marcus Johnson | September 10, 2026

The Hook: A Cautious Restart

In a September 10 post on X, Liquid said block production had resumed “without transactions” as a precaution while the network is monitored to “confirm full stabilization.” In plain English: the engine is idling again, but nobody can drive yet. Functionary nodes — the trusted computers that run this federated network — are signing and validating blocks as intended after emergency updates were deployed to both functionary and bridge nodes.

If you hold L-BTC (Bitcoin wrapped on the Liquid Network), this matters directly: peg operations, including PAK-authorized peg-outs — the process of moving your Bitcoin back to the main Bitcoin blockchain — are still on hold while the network rebuilds its BTC/L-BTC reserve.

What Actually Happened: The 4,000 BTC Withdrawal

Liquid paused all operations on September 6 after actors claiming to be white-hat hackers — ethical security researchers — withdrew about 4,000 Bitcoin, worth roughly 320 million USD at the time, from the network’s federation wallet. That represented about 95% of the wallet’s roughly 4,200 BTC balance.

The root cause, according to Cointelegraph, was a bug in Elements, the open-source software that underpins Liquid. Attackers exploited a proof-verification cache vulnerability to mint fraudulent L-BTC. Here is the twist: most of the money came back.

• 3,400 BTC returned — about 270 million USD — after Blockstream, the company behind Liquid, confirmed affected bridge nodes had been patched.
• About 598 BTC remained outstanding — roughly 46 million USD — as of September 7, per Cointelegraph.
• Elements v23.3.4 — the emergency software update released September 9 — hardened the cache keys used for range proofs, closing the vulnerability.

A range proof is the cryptographic trick that lets Liquid verify a transaction is valid without revealing the amounts involved. The bug lived in how those proofs were cached — like a bank re-using an old stamp of approval without re-checking the document.

The Core Conflict: Why “Federated” Security Got Tested

The episode is a reminder of how Liquid’s design differs from Bitcoin itself. Bitcoin’s main chain is secured by thousands of independent miners. Liquid is a federation — a group of functionary companies jointly managing the network and the Bitcoin locked in its wallet. That makes it faster and more private, but it concentrates trust. When the software connecting those fiduciaries has a flaw, nearly the entire reserve is exposed at once, as 95% of the wallet balance was here.

The good news: the response worked as the federation model intends. The network was halted within hours, the vulnerability was patched, and self-described white hats returned the overwhelming majority of funds — echoing other recent “return after patch” resolutions in the crypto world.

Market Implications: Limited Contagion, Clear Lesson

Bitcoin itself traded near 77,900 USD at the time of writing, and there is little sign the Liquid incident moved main-chain prices — the macro backdrop of hot inflation and rising bond yields is doing far more damage. L-BTC is a niche asset used mostly by traders seeking faster, confidential Bitcoin transfers, not a systemic pillar of the market.

Still, the lesson for regular investors is straightforward: wrapped or federated versions of Bitcoin add a layer of trust on top of Bitcoin’s core promise of not needing trust. If you hold L-BTC, you are accepting that a group of functionaries — and the software they run — can be a point of failure.

The Verdict

Liquid’s restart is genuine progress: blocks are being produced, the exploit is patched, and over 80% of the withdrawn Bitcoin has been returned. But the job isn’t finished — transactions remain disabled, peg-outs are suspended, and the reserve is still being rebuilt. Watch Liquid’s official channels for the moment full transactions resume. Until then, funds on the network remain in a waiting room, even as the lights come back on.

The cryptocurrency market remains highly volatile. This article is for informational purposes only and does not constitute financial advice.