Holders of L-BTC can blockchain, where users swap tokens directly from their own wallets without handing custody of their funds to a company.">swap it for bitcoin again. In a Liquid Network recovery update published on 20 October, the Liquid Federation said semi-automated swaps between BTC and L-BTC are running through participating swap providers, “without protocol-imposed volume limits on this service.” The federation’s own exit, the peg-out that turns L-BTC back into bitcoin from its reserve, stays closed. It will reopen only after the network’s full 1:1 bitcoin backing is restored, the federation wrote, and it gave no date for either step.
Six weeks after the 6 September hack, the federation’s own wording means the reserve does not yet cover every L-BTC in circulation. Blockstream’s Security Incident Assessment, first posted on the Blockstream blog on 23 September and republished on the Liquid blog on 25 September, puts the hole plainly: “Approximately 602 BTC remain outstanding.” With bitcoin near $82,580 at 06:04 UTC on 21 October, that is about $49.7 million.
The 20 October update says nothing about that figure. It does not say whether any of the 602 BTC has come back since September, who will cover it, or how many weeks separate the swap phase from the return of peg-outs.
Blockstream chief executive Adam Back posted on X that “LBTC:BTC swaps full service again”, according to Bitcoin Magazine, which embedded his post. Back pointed to two services: SideSwap, for swaps against bitcoin on the main chain, and Aqua, for swaps over the Lightning Network.
How Liquid holds bitcoin: 15 functionaries, 11 signatures
Liquid is a federated sidechain built by Blockstream. It runs on Elements, an open-source fork of Bitcoin’s code, and its main asset, L-BTC, is meant to be backed one for one by bitcoin held in a reserve that the federation controls. Users send BTC to that reserve to receive L-BTC (a peg-in) and burn L-BTC to get BTC back (a peg-out). Liquid is often filed under Bitcoin’s layer 2 networks, but it is not secured by Bitcoin’s own consensus: its blocks and its reserve depend on the federation’s members.
The members run 15 so-called functionary nodes, which the assessment describes as geographically distributed. “Blocks require signatures from at least 11 of the 15 functionary nodes to be accepted by the network,” the assessment says. The same members guard the reserve with hardware security modules.
Peg-outs are not open to everyone. Only members holding a peg-out authorization key, or PAK, can request one. Each PAK entry pairs an offline key, which fixes where the bitcoin may be sent, with an online key that signs the requests. Ordinary users who want BTC back go through a member that offers the service, such as SideSwap. In practice this makes Liquid’s peg a federated bridge between two chains, with the reserve as the vault at one end.
None of those keys was stolen in September. The assessment says the SideSwap PAK “was not compromised, forged or stolen.” The weakness sat in how Liquid nodes checked transactions, so the signers did what the software told them was valid.
What went wrong on 6 September, in brief
Coindaro covered the theft in its review of the third quarter’s crypto hacks, where Liquid’s roughly $320 million loss ranked second behind Bitget’s $387 million in Hacken’s count, as reported by Cointelegraph on 15 October. Blockstream’s post-mortem, which Coindaro read on 21 October, adds the technical chain of events.
It begins with a bug from 2018. Elements nodes keep a cache of range proofs they have already verified, the cryptographic checks that hide amounts in confidential transactions. The cache key left out the asset commitment and the output script, so a stored result could be reused where the proof was not valid. The assessment calls this Bug A. An outside researcher, stutxo, reported it to Blockstream on 2 August 2026. Blockstream patched its bridge nodes on 3 August, 13 of the 15 functionary nodes were updated by 11 August, and the fix was merged publicly on 1 September.
The fix created Bug B. It added the missing fields but joined raw bytes without length prefixes, and the length embedded in a range proof was only checked during full verification, which a cache hit skips. An attacker could therefore build a longer or shorter proof, adjust the script to match, and produce the same byte string as an existing cache entry. Nodes with that entry in memory accepted the transaction without checking it.
At 13:53 UTC on 6 September, Liquid block 4,050,336 confirmed a transaction that created about 4,000 L-BTC with no bitcoin behind them. The attacker tested a 2.5 L-BTC peg-out at 14:00 UTC, which SideSwap paid from its own inventory, then deposited about 4,000 L-BTC with SideSwap’s peg-out service at 14:05 UTC. At 14:28:56 UTC the federation signers released 3,996.02 BTC on Bitcoin, and SideSwap sent the coins on in the same block.
SideSwap’s setup made the run faster. According to the assessment, its peg-out signing key “was kept online despite the Federation Charter requiring it to be kept offline”, payouts went out automatically, and orders had no size limit, velocity control or wallet-history check. With a few smaller peg-outs confirmed before the halt, the reserve fell from about 4,205 BTC to 197 BTC. The bridge nodes were stopped at 18:26 UTC.
Blockstream does not spare itself. “No reviewer, internal or external, identified this risk prior to exploitation,” the report says. A mint of unbacked tokens on a bridge is not rare this autumn: on 18 October Cysic halted its bridge after 10 million CYS were minted without backing.
From the halt to the swaps: the timeline in figures
The times below come from the assessment’s timeline, except the 20 October entry.
| Date (UTC) | Event | Figure |
|---|---|---|
| 2 Aug 2026 | Researcher stutxo reports Bug A to Blockstream | Fix on 13 of 15 functionaries by 11 Aug |
| 6 Sep, 13:53 | Exploit transaction in Liquid block 4,050,336 | About 4,000 unbacked L-BTC |
| 6 Sep, 14:28:56 | Federation signers release the peg-out | 3,996.02 BTC |
| 6 Sep, 18:26 | Bridge nodes halted, network paused | Reserve down from about 4,205 to 197 BTC |
| 7 Sep, 16:09:25 | Attacker returns part of the bitcoin | 3,400 BTC |
| 9 Sep, 21:05:10 | Block production resumes with a replacement block 4,050,336 | Elements v23.3.4 released that day |
| 10 Sep, 19:55 | Transactions resume network-wide | Peg-outs still disabled |
| 23 Sep | Blockstream publishes its assessment | About 602 BTC still outstanding |
| 20 Oct | Swaps via providers reopen; peg-outs still shut | No protocol volume limit on swaps |
To restart, Blockstream replayed the chain with the range-proof cache switched off and cross-checked the result with a second implementation, rust-elements. Two invalid outputs and four transactions that descended from them were removed, and the report states that no inflation from either bug remains on the current chain. Valid transactions were then replayed, starting with 329 of them in block 4,050,337.
Liquid Network recovery: swaps first, peg-outs only after full 1:1 backing
The federation’s update is short and technical. “Over the past several weeks”, it says, the federation, Blockstream and independent security experts strengthened network security, refactored the network’s accounting and validated safeguards. Updated federation software that manages the bitcoin reserve has been deployed. The changes “accommodate the network’s post-incident accounting state”, a phrase the post does not explain.
Enough functionaries have installed the new software, according to the update, for the network to reach “an important state of operational readiness for the next phase of recovery.”
Phase one: semi-automated swaps through providers
The step now under way is a set of semi-automated BTC to L-BTC swaps run by participating providers, in both directions. The federation presents it as the practical route for most users while direct peg-outs remain restricted. A swap is a trade: the provider takes your L-BTC and sends you bitcoin from its own stock, at a rate it sets. It is not a redemption from the reserve.
Phase two: restore the backing, then reopen peg-outs
The last phase has two conditions in a fixed order. First the network’s full 1:1 bitcoin backing must be reestablished. Only then will federation peg-outs come back, in a controlled way, for holders of authorised PAK keys. The federation also plans to let anyone monitor the reserve through block explorers, subject to remaining security and operational requirements.
“Multiple independent safeguards remain in place to prevent premature or unauthorized peg-outs,” the post says. It sets no date for the second phase, and it does not say how the reserve will get back to full backing: through the return of the missing bitcoin, a contribution from Blockstream or the members, an adjustment to L-BTC balances, or something else.
The missing 602 BTC and the white-hat claim
The attacker announced itself on-chain at 18:30 UTC on 6 September with the message “we are whitehats. contact us on chain.” The next day, 3,400 BTC came back “after several rounds of negotiations”, according to the assessment, which urges the person behind the attack to return the rest.
The size of the rest depends on who is counting. On 8 September Decrypt and CoinDesk put it at about 598.5 BTC and about 598 BTC respectively, and CoinDesk quoted Samson Mow, a former Blockstream chief strategy officer who was posting updates, saying “Approximately 598 BTC remains outstanding.” Blockstream’s own report says about 602 BTC. Bitcoin Magazine wrote on 20 October that the hackers still hold roughly 600 BTC. None of these sources explains the gap of three to four bitcoin between the figures, and none reports any bitcoin returned after 7 September.
Whether the attacker was paid is not established. Bitcoin Magazine reported on 20 October that the hackers demanded 10% of the bitcoin as a bug bounty and threatened to publish Blockstream’s encrypted messages from their exchange if they were not paid. It quoted a message reading “You SHALL pay 10% using your own money as bug bounty” and linked to a third-party page presenting the group chat. Coindaro could not verify that exchange, and Blockstream has not confirmed it. Blockstream’s assessment lists a bug bounty programme only as a future measure and mentions no payment. Bitcoin Magazine also wrote that it is unclear whether Blockstream reached a private settlement.
The white-hat label drew doubts from the start. Ledger’s chief technology officer Charles Guillemet wrote at the time that “it looks more like extortion than white-hat hacking!”, as reported by Decrypt on 8 September.
Can you get your bitcoin out of L-BTC today?
Yes, through a swap, according to the federation and Adam Back. Holders who want bitcoin on the main chain can use SideSwap, and those who want to leave over Lightning can use Aqua, the two services Back named. The update sets no protocol limit on swap volume, though each provider can still apply its own rules.
What the update does not give is a price. A swap is quoted by the provider, and Coindaro did not check a live L-BTC to BTC rate for this piece, so it cannot say whether swaps trade at par. Holders can compare the quote they receive with the 1:1 ratio L-BTC is supposed to carry before confirming.
Direct peg-outs were never a retail tool: they are reserved for PAK holders, which is why most users relied on members like SideSwap even before September. The update does not say how swap providers will refill their bitcoin while the federation’s own peg-out stays shut.
Other assets on Liquid, including Tether’s USDT, were not affected by the bug, Decrypt reported on 8 September, although nobody could move them while the network was paused. The episode is also a reminder of what holding L-BTC means: a claim on a reserve run by a federation, not bitcoin in your own keys. Our guide to crypto wallets and custody explains the difference.
What to watch next
The first date to watch is the one the federation has not given: the reopening of peg-outs, which depends on the reserve again covering every L-BTC. The promised reserve monitoring through block explorers would let anyone check that ratio. Until then, the current state of the chain is visible on Blockstream’s Liquid explorer, but the update does not say when the reserve view will be added.
The assessment also lists changes still to come: a mandatory independent security audit before critical production fixes are released, recurring reviews of consensus-critical code even when it has not changed, expanded fuzzing and other testing, a bug bounty for Elements, and changes to federation governance and operations that are pending formal adoption. Blockstream’s report gives no date for any of them.
On the missing bitcoin, the last word in Blockstream’s report is unchanged since September: about 602 BTC “remains subject to ongoing recovery efforts.”