Liquid Network restarts block production after a $320 million attack

Liquid Network resumes block production after a major Bitcoin withdrawal event

Liquid Network has resumed block production after fixing vulnerabilities in the underlying open source software Elements. The restart was related to a major security incident involving large bitcoin withdrawals. Liquid said it is bringing the system back online in a cautious phased manner: only block generation is currently enabled, while transaction processing and anchoring (Peg) operations remain suspended so the team can continue to perform recovery and monitoring.

Key Points

Liquid has resumed block production, but trading and related anchoring activities remain suspended during the recovery period. Liquid pointed out that after making necessary updates to functional nodes and bridge nodes, functional nodes are now able to sign and verify blocks normally. However, anchoring operations, including PAK authorized withdrawals, remain suspended until Liquid resumes its BTC/L-BTC reserves.

Previously, an urgently released Elements update (v23.3.4) addressed a certification verification cache vulnerability related to this incident.

Block production resumes-transaction functions remain offline

Liquid's latest status update defines this restart as a precautionary measure rather than a full resumption of operations. According to the network description, block production is running in a "no transaction" state. This means blocks can be generated on the chain, but the system will not process real-time transaction traffic until the team confirms that all components are operating as expected.

Liquid also emphasized that necessary changes have been pushed to the functional node and bridge node infrastructure. Function nodes can now sign and verify blocks as usual, which is critical to the consensus behavior of the network.

This distinction is significant for users and developers. Restarting block generation helps confirm that some functions of the network stack are functioning properly, but suspending transaction processing reduces operational risks and avoids introducing additional complexity during a sustained stabilization period.

Anchoring operations are suspended pending reserve recovery

Although block production has resumed, Liquid made it clear that anchoring operations have not been restarted. The anchoring process-particularly including withdrawals authorized by PAK-remains suspended as the network continues to work to restore its BTC/L-BTC reserves.

The suspension highlights the core issue behind the exploit: the withdrawal affects cybersecurity's ability to implement anchoring mechanisms. Therefore, Liquid's next step depends not only on software hardening, but also on whether the relevant reserves and associated components have fully returned to normal.

Emergency Elements patch strengthens certification verification cache

The resumption of this activity follows previous interventions. The day before the reboot, Liquid released an emergency update to Elements (version 23.3.4) in response to incidents related to the attestation verification cache vulnerability.

Liquid's emergency update focuses on "strengthening cache keys used for Range Proofs" as part of its recovery plan. From a practical perspective, proof of scope is a mechanism to verify the value of confidential transactions without revealing the underlying amount. If the attestation verification behavior is accidentally affected due to caching or key issues, an attacker may find a way to undermine the verification assumptions.

By addressing cache key processing issues, Liquid stated that the recovery plan requires both patching the software layer and verifying that the patched infrastructure is working correctly among alliance node operators.

Review of September withdrawals

On September 6, Liquid suspended operations when activists who called themselves "white-hat hackers" withdrew about 4,000 bitcoins (worth about $320 million at the time) from the network's alliance wallet. This withdrawal accounted for approximately 95% of the wallet's approximately 4,200 bitcoins balance.

According to early reports cited in Liquid Network's own update, the withdrawal involved L-BTC derived from the Elements vulnerability. This connection is important because it narrows the root cause to a specific level of the system: the confidential transaction/proof verification component and how it interacts with caching and proof of scope verification.

After the withdrawal occurred, the actor returned 3,400 bitcoins (worth approximately $270 million at the time) after Blockstream confirmed that the affected bridge node had been repaired. Early reports also showed that as of September 7, there were still about 598 bitcoins (about $46 million at current prices) outstanding.

This "withdrawal, patch confirmation, partial return" process explains why recovery needs to be carried out in multiple steps. Even if software changes are deployed and some funds are returned, the anchoring mechanism cannot be safely restored until reserves and operating invariants are fully restored.

Liquid's current "no transaction" approach aims to decouple network health verification (block signing/verification) from settlement and anchoring flows, which require complete assurance of reserves and security assumptions.

Liquid users need to pay attention to subsequent developments

Liquid has not announced a timetable for transaction processing or coin withdrawal restart, so the current focus is on whether the network has confirmed "complete stability" in real-time conditions and whether the BTC/L-BTC reserve has returned to a level sufficient to lift the anchoring suspension. For any user using Liquid for token transfers or anchoring activities, the next operational update on anchoring recovery will be a decisive signal.