Liquid Network resumes cash withdrawal after $320 million in Bitcoin withdrawal

Liquid Network resumes block production, but temporarily stops processing transactions

Liquid Network has resumed block production after a US$320 million bitcoin withdrawal forced the suspension of sidechains operations, but has not yet processed any transactions. The Functional node has resumed signing and verifying blocks after receiving the necessary software updates. However, Liquid said that transaction processing and BTC anchoring operations will continue to be suspended so that the network can monitor current conditions.

The hackers have returned 3,400 BTC, and approximately 598 BTC are still outside the alliance wallet. Elements v23.3.4 changes the way software verifies and stores confidential transaction certificates. Liquid Network said in an update on Thursday that its Functional nodes have regenerated blocks as expected, but that the network will run "without transactions" while developers monitor network status.

This limited restart allows Liquid to test its updated infrastructure without reopening transfers or exposing the anchored system to new activity. According to networks, disabling transactions helps operators "confirm full stability" before resuming other services. Liquid added that Functional and bridge nodes have received the required software changes. Now, its Functional can sign and verify blocks, although users are not yet able to send regular transactions or transfer funds between Bitcoin and Liquid.

Anchoring operations also remain suspended, including withdrawals approved through Peg-out Authorization Keys (PAKs). Liquid said these restrictions will remain in place while it works to restore reserves to support L-BTC issues on the sidechains.

Liquid Network lost US$320 million due to cache vulnerability, attacker forged unsupported bitcoins

Liquid Network restarted but turned off trading functions

Block production is only part of Liquid's recovery service because its trading system and bridging system are still unavailable. The network has not provided a date for reopening any of the functions.

Under normal circumstances, users deposit BTC into an anchored pool controlled by the federation and receive the same amount of L-BTC for use on Liquid. Holders can then destroy L-BTC through the approved anchored withdrawal service to release the corresponding bitcoins on the base layer.

The operator stopped the process because an actor took advantage of a certification verification flaw in Elements (the open source software behind Liquid) to create unsupported L-BTC. The actor then submitted these tokens through SideSwap's authorized anchor withdrawal service, prompting the alliance to release the real bitcoins.

Previously reported that the deal removed approximately 3,996 BTC, reducing the alliance wallet from approximately 4,205 BTC to approximately 202 BTC. This withdrawal accounted for approximately 95% of the bitcoins held in the wallet at the time.

Liquid describes these actors as "self-proclaimed white-hat hackers" because they call themselves white hats through messages accompanying Bitcoin transactions. Their statements did not confirm that they had the right to create L-BTC or withdraw the underlying Bitcoin.

SideSwap stated that a customer sent 4,000 L-BTC to its anchored withdrawal service, which processed the request in its normal system. Liquid and SideSwap said the keys used to authorize transactions were not stolen.

Elements Update Changes Proof Verification Cache

One day before restarting block production, Liquid released an emergency Elements update aimed at addressing withdrawal-related defects. According to Liquid, Elements v23.3.4 changes the cache key used when validating range proofs. Scope proof allows the network to validate hidden transaction amounts without disclosing them publicly, as part of Liquid's confidential trading system.

Affected software stores successful proof validation results so that nodes can reuse them without having to repeat complete calculations. Previous reports have found that the cache does not contain enough transaction contexts, causing valid proof results to be reused when they should have failed.

Taking advantage of this vulnerability, actors created L-BTC without first locking the same amount of Bitcoin in the alliance wallet. The Functional node running the affected code accepted the tokens, and SideSwap's anchored withdrawal process treated them as valid L-BTC and processed withdrawals.

Liquid said version 23.3.4 strengthens cache keys related to proof of scope. Functional and bridge nodes had received updates before the block signing restart, and the network suspended transactions even though the operator was still checking the deployment.

Liquid's coalition uses Functional nodes to identify side link blocks and control the bitcoins behind L-BTC. According to an early technical description of the event, the system relied on 15 rotating Functional Codes and required 11 signatures to move funds from its multi-signature wallet.

It was reported that no alliance signature keys were stolen during the withdrawal process. Failure involves the software used to determine whether the submitted L-BTC is valid.

Hacker returned 3,400 BTC after node patching

Communication between Blockstream and actors is through messages embedded in Bitcoin transactions. In one message, the actor stated that assets would be returned after the vulnerable node was repaired.

"Please fix the vulnerability first," the message read,"Make sure every node is patched. Then after confirming the repair, we will safely transfer the funds back."

Blockstream then sent a signed message stating that its bridge node had been patched and that Bitcoin "can be safely returned." After this confirmation, the actors transferred 3,400 BTC back to the Alliance Wallet.

This repayment of 3,400 BTC restored approximately 85% of the withdrawn funds. At the time of the transfer, the value of the returned Bitcoin was approximately $270 million.

After the repayment, approximately 598.5 BTC remained in the address related to the withdrawal. Based on the bitcoin price cited in the report provided, the value of the outstanding balance is approximately $46 million, although its dollar value changes with market fluctuations.

There is currently no public agreement to determine the remaining bitcoins as an approved bounty. The actors have not publicly said whether they plan to return another portion of the money, and Blockstream has not announced conditions that will allow them to retain the balance.

Charles Guillemet, chief technology officer of Ledger, questioned the "white hat" label after a partial repayment. He posted on X (formerly Twitter) that retaining about 600 BTC without a public disclosure clause looked more like extortion than a standard security reward.

L-BTC holders wait for anchor services to resume

Liquid is a federal Bitcoin sidechain that allows exchanges, trading companies and other users to transfer assets linked to BTC with shorter settlement times, superior to the Bitcoin base layer. Blockstream launched its production network in 2018 using Elements software.

L-BTC relies on Bitcoin held in the alliance wallet to maintain its one-to-one support. Until Liquid resumes anchoring operations, the holder cannot use the normal bridging process to convert L-BTC to native Bitcoin.

Previous Bridge Security Interpreters described how systems that lock assets on one chain and issue associated tokens on another chain rely on their custody, verification, and message processing controls. Failure in any part of the process can cause redemption to be suspended, even if the underlying blockchain continues to operate.

For U.S. users, the current impact is limited to access and operations, rather than explicit changes in federal policy. L-BTC holders in the United States face the same trading and anchoring restrictions as users in other regions, while BTC held directly on the Bitcoin base layer is separated from the Liquid system.

No U.S. regulatory or law enforcement agency has announced actions related to this withdrawal. Liquid also did not give a timetable for resuming transactions, PAK-authorized anchored withdrawals or other bridging operations.