Block production has restarted under a controlled recovery process after an exploit drained almost 4,000 BTC from Liquid’s federation wallet. Transaction and peg operations remain suspended while Blockstream works to secure the network and recover the remaining funds.
The Liquid Network has begun a controlled recovery following a major security incident that resulted in the unauthorized withdrawal of nearly 4,000 BTC from its federation wallet.
The attacker, who described themselves as a white-hat hacker, later returned approximately 3,400 BTC, while retaining nearly 600 BTC. The network has now resumed block production, but users cannot yet conduct normal transactions or use Bitcoin peg operations while the team evaluates the system’s stability.
Blockstream has also pledged to maintain the 1:1 backing of L-BTC, the Bitcoin-linked asset issued on the Liquid sidechain.
Liquid Restarts Block Production Under Controlled Recovery
Liquid announced that it had entered the next stage of its recovery process, with block production restarting without transaction processing.
The decision represents a cautious step toward restoring the network after the exploit forced operations to be halted.
The team said it is continuing to monitor the network before allowing regular transactions to resume.
Peg-related activity also remains suspended. This includes PAK-authorized peg-outs, which allow L-BTC to be converted back into Bitcoin.
According to Liquid, restoring the BTC/L-BTC reserve is part of the final recovery process.
The staged approach means that the network’s blockchain can begin producing blocks again while more sensitive functions remain disabled.
Exploit Drained Almost 4,000 BTC
The incident occurred on Sunday when an attacker gained control of the federation wallet and withdrew approximately 4,000 BTC.
The scale of the withdrawal made the incident one of the most significant security events involving Liquid in 2026.
The subsequent shutdown affected more than Bitcoin transfers.
With Liquid’s operations frozen, users holding other assets on the sidechain, including stablecoins, were also unable to move or otherwise control those assets normally.
The incident therefore created a broader liquidity and operational disruption across the network.
Hacker Returns 3,400 BTC
Following the exploit, Blockstream began communicating with the attacker through onchain messages.
The hacker subsequently returned approximately 3,400 BTC, leaving close to 600 BTC still under their control.
Blockstream has continued efforts to recover the remaining funds.
The attacker has reportedly demanded a 10% bounty in exchange for returning the remaining Bitcoin. In a September 9 message, the anonymous hacker criticized Blockstream’s security spending and claimed the company had allocated only $1.5 million to protect assets worth approximately $5 billion.
The hacker warned that failure to provide the requested bounty could result in the unrecovered Bitcoin being retained.
These claims come from the attacker and have not been independently established in the supplied information.
Blockstream Says L-BTC Will Remain Fully Backed
The exploit created immediate questions about the backing of L-BTC, Liquid’s Bitcoin-linked asset.
Blockstream founder and CEO Adam Back sought to reassure holders that the L-BTC-to-BTC relationship would be maintained at a 1:1 ratio.
Under that commitment, users should be able to redeem their L-BTC for an equivalent amount of Bitcoin once peg-out operations are restored.
However, the remaining roughly 600 BTC shortfall raises questions about how the reserve gap will ultimately be addressed.
Back did not provide details in the supplied statement about the mechanism that would cover the missing Bitcoin once normal peg-outs resume.
He also urged users not to panic sell L-BTC over the counter while the recovery process continues.
Peg-In and Peg-Out Operations Remain Frozen
Although block production has restarted, the most important user-facing functions have not yet been restored.
Peg-ins and peg-outs remain suspended, meaning users cannot currently move Bitcoin into or out of Liquid through the normal mechanisms.
The Liquid team has indicated that additional system updates are required before these services can resume.
No specific timetable has been provided for the restoration of full transaction and peg functionality.
This makes the current restart a limited recovery milestone rather than a complete return to normal operations.
Security Concerns Come Under Scrutiny
The incident has also triggered questions about the security architecture and spending priorities surrounding Liquid.
The anonymous hacker publicly criticized Blockstream’s security budget, claiming that only $1.5 million had been allocated to protect approximately $5 billion in assets.
The attacker characterized the alleged security spending as inadequate and tied the return of the remaining funds to the proposed 10% bounty.
The allegations have not been independently verified based on the information provided.
Nevertheless, the episode is likely to intensify discussion about how networks managing large pools of digital assets structure their security systems, wallet controls and emergency response procedures.
Liquid Recovery Moves Into Its Next Phase
The restart of block production marks an important step for Liquid, but the network is still operating under significant restrictions.
The current recovery status can be summarized as:
- Block production: Resumed
- Normal transactions: Still suspended
- Peg-ins: Suspended
- Peg-outs: Suspended
- BTC returned by attacker: Approximately 3,400 BTC
- BTC still unrecovered: Nearly 600 BTC
- L-BTC backing: Blockstream says it will maintain 1:1 coverage
- Full restoration timeline: Not specified
The immediate priority is to ensure that the network is secure and stable before restoring transaction and peg functionality.
Bottom Line
Liquid has moved from a complete operational freeze to a controlled block-production restart, but the network is not yet fully operational.
The return of roughly 3,400 BTC has reduced the size of the loss, while nearly 600 BTC remains unrecovered. Blockstream’s commitment to maintain L-BTC’s 1:1 backing provides reassurance to holders, but questions remain over how the reserve shortfall will be handled.
Until the security updates are completed and peg operations resume, Liquid users will need to wait for the next stage of the recovery.
