Liquid Network Restarts Block Production After Major Bitcoin Withdrawal Incident

This incident highlights vulnerabilities in blockchain technology that can impact trust and operational stability across the cryptocurrency ecosystem.

• Block production resumed on September 10, 2026, after a $320 million Bitcoin withdrawal on September 6.
• A software vulnerability allowed white-hat hackers to exploit the Liquid Network, draining approximately 3,996 BTC from the federation wallet.
• 3,400 BTC were returned after a patch was deployed, but peg operations and user transactions remain suspended as the network stabilizes.

• Liquid Network is a federated Bitcoin sidechain launched in 2018, designed for faster and confidential transactions using L-BTC backed by BTC.
• On September 6, 2026, a vulnerability in the Elements software allowed the creation of unbacked L-BTC, leading to the withdrawal of real BTC from the federation wallet.
• The incident has raised concerns about the security of blockchain infrastructures, particularly in federated systems where trust is essential for operation.

On September 6, 2026, the Liquid Network experienced a significant security breach when actors exploited a vulnerability in the Elements software, which is crucial for the operation of the sidechain. This vulnerability allowed them to mint unbacked L-BTC, which they then used to withdraw approximately 3,996 BTC—around $320 million—from the federation wallet. This withdrawal represented about 95% of the reserves held in the wallet, drastically reducing the available BTC to approximately 202 BTC.

The actors behind this exploit identified themselves as white-hat hackers, indicating their intention to return the funds after a fix was implemented. Following the incident, bridge nodes were disabled to prevent further withdrawals. On September 7, a significant portion of the stolen funds—3,400 BTC—was returned, demonstrating a level of accountability and a commitment to restoring the network's integrity.

In response to the exploit, Blockstream released Elements v23.3.4 on September 9, which aimed to harden the proof-verification cache and prevent similar vulnerabilities in the future. By September 10, block production resumed in a controlled mode, although transaction processing and peg operations remained suspended. This cautious approach reflects the network's priority on stabilization and restoring reserves before fully resuming operations.

The incident has broader implications for the cryptocurrency market, particularly for users of L-BTC who are currently facing suspended redemptions. Adam Back, CEO of Blockstream, has confirmed that the 1:1 peg between L-BTC and BTC will be maintained, but the remaining 598 BTC that were not returned remains a point of concern. The lack of governmental or regulatory responses indicates that the incident has not yet triggered significant market panic, but it does raise questions about the security measures in place for blockchain technologies.

As the Liquid Network works to stabilize and restore its operations, the incident serves as a reminder of the vulnerabilities that exist within blockchain systems, particularly those that rely on federated models. The balance between innovation and security will be critical as the industry moves forward.

• L-BTC holders: Facing suspended redemptions and potential loss of liquidity.
• Traders and investors: May experience increased volatility in Bitcoin prices due to uncertainty.
• Blockchain developers: Will need to reassess security protocols and vulnerabilities in similar systems.
• Regulatory bodies: Might increase scrutiny on blockchain security practices following this incident.

• Network stability: Monitor how quickly Liquid Network can restore full operations and the impact on L-BTC holders.
• Regulatory responses: Watch for any emerging regulations or guidelines aimed at enhancing blockchain security.
• Market reactions: Observe Bitcoin price movements and trading volumes as the incident unfolds and confidence in the network is tested.