Crypto07 September, 20262 min read
Liquid Network Restarts Block Production After $320 Million Elements Exploit Drains 4,000 BTC
This article is an automated aggregation of coverage from news outlets. Our editorials offer in-depth analysis curated by the NewsCord team.
Approximately 4,000 BTC ($320 million) were withdrawn from Liquid Network's federation wallet. Block production resumed after emergency updates; transactions and peg operations remain paused.
One story. Different accounts.
“Ledger Chief Technology Officer Charles Guillemet questioned the white-hat label after the partial repayment.”
“Blockstream is in talks to recover approximately 598.5 BTC still outstanding after the Liquid exploit.”
Explore source coverage 5 source types
Directory totals describe our source library, not outlets checked for this story.
4,000 BTC drained
Liquid Network restarted block production after a $320 million Elements exploit that drained roughly 4,000 BTC from its federation wallet on Sept. 6, while transactions and peg operations remained paused.
Altcoin Buzz said about 4,000 BTC, worth roughly $320 million, was withdrawn from the federation wallet by actors claiming to be white-hat hackers, and that the withdrawal represented about 95% of the wallet's 4,200 BTC balance.
Analytics Insight reported Liquid recovered 3,400 BTC worth about USD 268 million on Monday after the weekend exploit drained roughly 4,000 BTC, and said about 600 BTC, or 15% of the withdrawn amount, remains with the attacker.
Liquid said block production resumed "without transactions" as a precaution while operators monitor the network to "confirm full stabilization," and Cointelegraph reported that peg operations, including PAK-authorized peg-outs, remain suspended while the network works to restore its BTC/L-BTC reserve.
White-hat dispute
Liquid said the actors told Blockstream they would return most of the 4,000 BTC after the Elements vulnerability is patched across the network, but Ledger Chief Technology Officer Charles Guillemet questioned the white-hat label after the partial repayment. Analytics Insight quoted Guillemet saying, "keeping approximately 600 BTC did not fit a genuine bug-bounty arrangement" and described it as closer to extortion.
Decrypt reported Liquid said "Discussions between Blockstream and the individuals responsible are ongoing" to secure the return of the remaining funds, after the hackers returned 3,400 BTC Monday and left roughly 15% unreturned. Decrypt also quoted Liquid attempting to reassure users that "The peg-out mechanism that authorizes withdrawals to whitelisted addresses operated as designed," while noting that the validation failure occurred at the transaction level before the peg-out was initiated.
What’s at risk
With L-BTC deposits and withdrawals suspended, Liquid’s paused state left users unable to transact on the sidechain while the network worked to restore its BTC/L-BTC reserve and verify backing.
“About 598 BTC, worth roughly $46 million at current prices, remained outstanding as of Sept. 7.”
Altcoin Buzz said peg operations, including PAK-authorized peg-outs, remain suspended while the network works to restore its BTC/L-BTC reserve, and it reported that about 598 BTC, worth roughly $46 million at current prices, remained outstanding as of Sept. 7.
Decrypt said Liquid’s reserve fell from approximately 4,205 BTC to 197 BTC after the withdrawal and other transactions were processed before operations halted, and it reported that USDT and other Liquid-issued tokens were unaffected by the vulnerability.
The incident report also framed the next steps as recovering remaining funds and resuming normal network operations safely, with Liquid saying "Our immediate priorities are recovering the remaining funds and resuming normal network operations safely and as quickly as possible," while Cointelegraph reported that transactions and peg operations remain suspended as recovery efforts continue.