Liquid Network restores backing after US$320 million theft; direct Federation withdrawals still restricted
An Elements flaw let an attacker drain roughly US$320 million from Liquid's bitcoin reserves. Full L-BTC backing is restored, but direct Federation withdrawals remain restricted. SideSwap conversions are open; no wallet or key change is required.
If you hold L-BTC, no wallet or key change is required for this incident. SideSwap conversions to bitcoin are open with a 0.1% service fee, but payouts can wait for its wallet to be replenished. Check with your wallet or exchange about its withdrawal route, because direct Federation withdrawals remain restricted.
What’s happening
On 6 September, an attacker exploited Elements, the software underlying Liquid Network, to create about 4,000 L-BTC without depositing matching bitcoin. SideSwap accepted those tokens and processed a valid withdrawal, releasing approximately 3,996 BTC from Federation reserves, valued in initial reporting at roughly US$320 million. Liquid holders faced reduced reserve backing and a network pause. No authorisation keys were compromised. The attacker returned 3,400 BTC on 7 September. The Block initially reported about 598.5 BTC retained; Blockstream's later accounting put the recovery shortfall at approximately 602 BTC. Elements 23.3.4 fixed the exploited flaw, and transactions resumed on 10 September. By 3 November, reserve deposits had restored full one-to-one backing, but their funding source and whether the remaining stolen coins were recovered were not established in the updates reviewed. Direct Federation withdrawals remain restricted. SideSwap conversions to bitcoin are open but can queue while its payout wallet is replenished.
- What
- Breach
- Affects
- Liquid Network L-BTC and SideSwap's bitcoin withdrawal service
- Fixed in
- Elements 23.3.4
- Since
- 6 Sept 2026
Timeline
- Update
SideSwap confirmed full backing: 4,270.54 BTC against 4,270.54 L-BTC, following reserve deposits totalling 602.5 BTC. Their source was not identified; direct Federation withdrawals remained restricted, and SideSwap payouts could queue.
- Update
SideSwap reopened L-BTC conversions to bitcoin at one-to-one less its 0.1% fee, funding payouts from its own wallet. Direct Federation withdrawals remained restricted.
- Update
Blockstream's assessment put the outstanding recovery shortfall at approximately 602 BTC. It said an earlier fix addressed a different flaw but left the subsequently exploited defect.
- Update
Liquid confirmed that user transactions had resumed on the corrected chain. Withdrawals through the Federation remained disabled.
- New fix
Blockstream released Elements 23.3.4 for production use, fixing the exploited proof-verification flaw.
- Update
The attacker returned 3,400 BTC after Blockstream confirmed bridge nodes were patched. The Block reported about 598.5 BTC remaining in the attacker's wallet.
- Made public
Liquid publicly disclosed the incident. Blockstream says it had halted bridge nodes at 18:26 UTC, pausing the network.
- Update
An attacker created about 4,000 unbacked L-BTC through an Elements software flaw. SideSwap subsequently processed their withdrawal, releasing approximately 3,996 BTC from Federation reserves.
Sources
- Liquid Network Security Incident AssessmentBlockstream · 23 Sept 2026
- Statement on the Liquid Network incident of 6 September 2026SideSwap · 9 Sept 2026
- Liquid Network Staged Recovery UpdateLiquid Federation · 20 Oct 2026
- Peg-out is open again on SideSwapSideSwap · 20 Oct 2026
- The Liquid peg is back to one to oneSideSwap · 3 Nov 2026
- Liquid Network attacker returns 3,400 BTC after bug fix, retains nearly 600 BTCThe Block · 7 Sept 2026
- Bitcoin network used by exchanges hit by $320 million exploit. Hackers claim they're the 'good guys'CoinDesk · 7 Sept 2026