The Liquid Network, the Blockstream-built Bitcoin sidechain that halted operations on September 6 after actors claiming to be white-hat researchers withdrew roughly 4,000 BTC, has resumed block production and, hours later, transaction processing. Peg operations — the mechanism that lets users move BTC in and out of the sidechain — remain suspended.
The staged restart is the first sustained good news in an incident that at its peak put roughly $320 million, about 95% of the federation wallet's balance, outside the network's control.
A Restart in Two Steps
In a status update dated September 10 at 10:00 UTC, Liquid said block production had resumed "without transactions" as a precautionary step, with functionary nodes signing and validating blocks as intended after the required updates to functionary and bridge nodes were deployed.
Roughly ten hours later, a status update posted at 19:55 UTC confirmed that transactions had resumed. Peg-outs, including those authorized through the network's PAK system, remain unavailable while the network works to restore the BTC backing its L-BTC supply.
The restart follows the September 9 emergency release of Elements v23.3.4, the software underpinning the network, which hardened the cache keys used for range proofs — the fix for the proof-verification vulnerability that allowed unbacked L-BTC to be created and exchanged for real bitcoin through the federation's 11-of-15 multisig.
The Ledger So Far
Of the roughly 4,000 BTC withdrawn, 3,400 BTC — about $270 million at the time — was returned after Blockstream confirmed the affected bridge nodes had been patched. Approximately 598 BTC, worth roughly $46 million at current prices, remains outstanding. The actors behind the withdrawal, who self-identified as white hats in an on-chain message and later negotiated with Blockstream, have framed the remaining funds as a bounty claim; that characterization remains their own, and no arrangement has been publicly confirmed.
Blockstream co-founder Adam Back said on September 10 that the L-BTC to BTC one-to-one peg "will be covered," urging holders not to sell L-BTC at a discount over-the-counter while the reserve is restored. The commitment matters because the outstanding 598 BTC represents a hole in the backing that the federation, not users, must absorb for the peg to hold.
What Recovery Still Requires
A functioning block chain with resumed transactions is not the same as a closed incident. The open items are concrete: restoring peg-in and peg-out operations, rebuilding the BTC/L-BTC reserve to full backing, and resolving the status of the outstanding 598 BTC.
The exploit's lesson is also still settling. The vulnerability lived not in Bitcoin or in the multisig itself, but in Elements' handling of proof-verification caching — infrastructure code that every federation member ran. A patched federation is now signing blocks again; the incident reports that explain exactly how the fake coins were treated as valid are still to come.
TrustGrade covers the security and trust ecosystem around digital assets. For verified trust data on the platforms and firms shaping it, see trustgrade.ai.