Blockstream’s Liquid Network, a Bitcoin sidechain designed for fast and confidential transactions, restarted block production on Thursday after a major security breach led to the withdrawal of nearly 4,000 BTC from its federation wallet earlier in the week. The event triggered a temporary suspension of funds and raised concerns for users holding Liquid Bitcoin (L-BTC) and stablecoins on the network.
Timeline of the Security Incident
The disruption began on Sunday, September 6, when individuals identifying themselves as white hat hackers drained approximately 4,000 BTC, valued at around $320 million, from Liquid’s main wallet. This withdrawal represented nearly 95% of the wallet’s roughly 4,200 BTC balance at the time.
The hackers used SideSwap’s peg-out authorization key to access the funds. According to reports, this key was not stolen, but its legitimate use was exploited. Around 600 BTC, equivalent to $46 million to $47 million based on current prices, remain unrecovered in the attacker’s possession. This shortfall impacts the reserve that backs L-BTC and associated stablecoins on Liquid.
Liquid’s bridge and functionary nodes, which sign and validate blocks, have received security patches to address the vulnerability. However, peg operations—the process allowing users to move BTC into (peg-in) or out of (peg-out) the Liquid sidechain—remain disabled as the network seeks to reestablish its BTC-LBTC reserve balance.
Mini dictionary: SideSwap, a non-custodial Bitcoin wallet and exchange, facilitates atomic swaps and peg-out transactions on the Liquid Network, enabling users to transfer funds between Bitcoin and Liquid BTC with increased flexibility and security.
Blockstream Responds and Network Recovery
Blockstream, a Bitcoin infrastructure company led by CEO Adam Back, responded by releasing Elements v23.3.4. This emergency update fixed a vulnerability that had allowed attackers to generate invalid L-BTC and redeem it as though fully backed. The latest security measures included enhanced cache key controls to prevent further abuse.
After deploying the patch, Blockstream announced on-chain that bridge nodes had been secured and notified the attackers it was safe to return the funds. Subsequently, around 3,400 BTC—worth $269.2 million based on September 7 exchange rates—were returned. Despite this, a remaining 598.5 BTC has not been recovered.
| Event | BTC Amount | Value (Approx.) |
|---|---|---|
| Total withdrawn | 4,000 BTC | $320 million |
| Returned to Liquid | 3,400 BTC | $269.2 million |
| Outstanding | 598.5 BTC | $46–47 million |
The anonymous hacker criticized Blockstream’s security spending, alleging just $1.5 million was allocated to safeguarding $5 billion in assets. The hacker demanded a 10% bug bounty, threatening that the withheld funds would remain so without payment.
“You SHALL pay 10% using your own money as bug bounty or you will cause all your holders a 15% loss for your irresponsibility and stinginess,” the attacker stated in an on-chain message.
Future of Liquid BTC Peg and User Impact
Adam Back addressed community concerns and reassured users that the L-BTC peg will be maintained on a 1:1 basis, allowing users to redeem each L-BTC for one BTC once normal operations resume. However, no timeline has been provided for when peg-in or peg-out services will restart, and questions remain regarding the outstanding funds.
Back advised, “Do not panic sell OTC,” calling for users to remain calm while the network stabilizes.
Peg-outs remain frozen as the Liquid network continues recovery efforts. Liquid has now resumed block production and transaction processing, but is operating cautiously while monitoring network stability.
