Liquid Network Comes Back Online, But Money Is Still Stuck After $320M Bitcoin Hack

Liquid Network is running again, but only partly. The Bitcoin sidechain started producing blocks on September 10, days after hackers pulled roughly $320 million in Bitcoin out of its main wallet. Users still can't move funds or cash out, and that won't change until Liquid is sure its reserves are solid again.

What's Working and What Isn't

Think of block production as the network's heartbeat, the basic process of confirming and recording activity. That part is back. But actually sending Bitcoin in or out of the system, called a "peg," is still switched off. So is L-BTC, the token Liquid issues when someone locks up real Bitcoin.

That gap exists on purpose. Liquid's team wants to make sure every wallet balance matches what's actually sitting in reserve before it lets people move money again. Restarting blocks first, transfers later, is a deliberate, cautious sequence, not a sign the system is only half-fixed.

How the Hack Actually Worked

Here's the short version. Liquid runs on a system where locking up real Bitcoin lets you mint an equal amount of L-BTC, which you can then trade or eventually swap back for real Bitcoin. That swap-back step relies on proof that you're entitled to redeem it.

Attackers found a flaw in how that proof gets checked. They tricked the system into minting L-BTC that had no real Bitcoin behind it at all, then cashed it out through SideSwap, a platform Liquid normally trusts to process withdrawals. Because the system believed the fake L-BTC was legitimate, it let the Bitcoin walk out the door.

In total, about 3,996 BTC left the federation's wallet, dropping its reserves from roughly 4,205 BTC to just 202 BTC.

The Hackers Say They're the Good Guys

Whoever pulled this off didn't try to hide. They left a message onchain, telling Liquid to patch every node first and promising to send the money back once the fix was confirmed. Liquid has since described them as white-hat actors, meaning hackers who claim to expose flaws rather than profit from them, though the network was careful to note they never had permission to mint tokens in the first place.

So far, that promise has mostly held up. After Blockstream confirmed the patch was live, the attackers sent back 3,400 BTC, about 85% of what they took. The remaining 598.5 BTC, worth tens of millions of dollars, is still outside Liquid's control.

The Fix

Liquid pushed an emergency software update, Elements v23.3.4, before letting blocks start again. The update changes how the system caches and checks transaction proofs, closing the specific loophole that let the fake L-BTC get approved in the first place.

Liquid isn't run by one company. It's overseen by a federation of "functionaries," node operators who rotate over time, and it takes 11 of the network's 15 functionaries agreeing together to approve a Bitcoin transaction. Every one of those nodes had to be updated before block production could safely resume.

Why This Matters Beyond Liquid

Liquid isn't a small side project. Blockstream built it in 2018 specifically so crypto exchanges could settle trades faster than Bitcoin's own network allows, and today more than 80 exchanges, financial firms, and infrastructure providers rely on it as a shared settlement layer. A flaw at the heart of that system doesn't just affect Liquid's own users. It touches every exchange that treats L-BTC as if it were as safe as holding Bitcoin directly.