The Liquid Network sidechain has initiated controlled block generation to restore operations following a security breach valued at approximately $320 million, with the recovery process commencing on September 10, 2026. Blockstream and the federation of functionary nodes have completed the initial technical remediation steps, yet commercial transaction capabilities remain offline for end users as the system continues to operate under heightened security protocols.
The root cause of this security incident traces back to September 6, 2026, when the network experienced an attack at block height 4,050,336. The attacker exploited a vulnerability within the open-source Elements codebase, illegally minting nearly 4,000 units of Liquid Bitcoin (L-BTC) without posting any collateral. These virtual currency units were transferred through the SideSwap exchange service, utilizing specific peg authorization keys (PAK) to execute the fund movements. Because the flaw resided in the transaction pre-validation process, federation nodes erroneously approved these transactions as valid, causing the Bitcoin balance within the multisignature wallet to plummet from 4,205 BTC to 197 BTC within minutes. Notably, technical reports confirm that none of the 15 federation members' private keys were compromised.
On September 7, 2026, the attacker communicated via on-chain messages, identifying themselves as a security researcher, and subsequently returned 3,400 Bitcoin to the multisignature address. According to compiled data, approximately 598.5 Bitcoin—valued at around $47 million—remains unrecovered to this day. The attacker has demanded a 10% bounty in exchange for returning the remaining assets, though Blockstream has not officially recognized this as a sanctioned bug bounty program.
Regarding accountability and technical remediation, SideSwap released an incident analysis report on September 9, 2026, acknowledging operational management oversights, including the failure to promptly disconnect PAK keys from internet connectivity, the absence of automated transaction velocity monitoring mechanisms, and the lack of transaction limits configured for different wallets. On the same day, the federation of nodes urgently deployed a hotfix in version Elements v23.3.4, developed after collaborative audits with professional security firms including the Bitcoin red team and Alpen Labs, designed to address cache key management issues within the range proof functionality.
While deposit and withdrawal functions remain disabled and the conversion feature is frozen, other assets issued on the network—such as the stablecoin Tether (USDT) and various real-world asset (RWA) tokens—have remained unaffected throughout the mandatory downtime. The restart occurred at 12:26 UTC, at which point node upgrades had been completed and synchronization operations reached the predetermined threshold, allowing validator nodes to begin signing empty blocks while continuously monitoring system stability.
Blockstream CEO Adam Back has publicly committed to fully guaranteeing the 1:1 peg relationship between L-BTC and Bitcoin, providing institutional-level assurance that helps mitigate the risk of panic selling in over-the-counter (OTC) markets. The network recovery process is structured in three phases: the first involves generating controlled blocks; the second entails reprocessing validated legitimate transactions; and the third phase will restore the pegging relationships across currencies once all reserve funds are fully secured. Looking ahead, the federation of nodes will publish a comprehensive technical audit report and complete various stress tests before fully reopening the cross-chain bridge, marking a critical test for the sidechain ecosystem as it seeks to balance security and usability in the aftermath of this significant on-chain vulnerability.
Comments