Liquid Network Halts Operations After $320M Bitcoin Peg-Out

Liquid Network, a Bitcoin sidechain, has paused operations after a security incident drained nearly all of its reserves. On September 6, an unknown entity exploited a bug in the open-source Elements software used by Liquid to create and redeem L-BTC tokens.

The attack resulted in the release of approximately 3,996 BTC worth around $320 million from Liquid's federation wallet, leaving only about 200 BTC remaining. This represents roughly a 95% reduction in the reserve backing L-BTC.

The incident unfolded through SideSwap's peg-out authorization key (PAK), which is authorized to request Bitcoin redemptions from Liquid's federation. However, the L-BTC presented for redemption originated from an apparent bug in Elements, rather than a compromised bridge key or multisig takeover.

Liquid has not yet published a technical analysis of the exact Elements vulnerability responsible for the incident.

The withdrawn funds were consolidated into a Bitcoin address holding approximately 3,998 BTC and included a message claiming to be from 'whitehats.' Blockstream responded with contact information for its security team as efforts began to establish communication with the address controllers.