Liquid Network Withdrawals Still Frozen Five Weeks After $320 Million Elements Exploit

Five weeks after an attacker exploited a flaw in Blockstream's Elements software underpinning Liquid Network, withdrawals of bitcoin from the sidechain remain suspended. The reserve backing L-BTC tokens currently covers just 85.8% of circulating supply, leaving a gap of approximately 603 BTC, worth around $50 million, before parity can be restored.

The exploit took place on September 6, when a vulnerability in Elements allowed the creation and redemption of L-BTC without proper authorization. According to Blockstream's incident report, published September 23, the underlying flaw in Elements' caching mechanism had existed since 2018. At 13:53 UTC on September 6, the attacker generated roughly 4,000 L-BTC with no bitcoin backing them, first testing the exploit with a withdrawal of 2.5 L-BTC before scaling up. The entire operation took 35 minutes. By 14:28 UTC, the federation had released 3,996.02 BTC on the Bitcoin network, draining a reserve that had stood at approximately 4,205 BTC before the attack.

Blockstream's report notes that the attacker did not compromise the federation's signing keys or SideSwap's withdrawal key. Instead, SideSwap's automated system processed the withdrawal requests without a cap or human review, allowing the drained funds to move quickly. USDT issued on the Liquid Network was not affected by the exploit.

Partial recovery, lingering shortfall

A white-hat actor returned 3,400 BTC to the network on September 7, a day after the exploit. That left between 598 and 603 BTC still unaccounted for. A hacker involved in the incident had demanded a 10% bug bounty on the funds still held, a demand Blockstream rejected. The company announced on September 11 that it would not pay a ransom.

Each L-BTC currently in circulation is backed by approximately 0.86 BTC rather than a full bitcoin. Data from the Liquid Network explorer shows 3,632.23 BTC held in reserve against 4,234.76 L-BTC in circulation, a discrepancy that has kept peg-outs frozen for 35 days.

Conditions for reopening

Liquid resumed block production and ordinary transactions on September 10, four days after the exploit, but withdrawals back to the Bitcoin mainnet have not followed. The network has set four conditions before peg-outs can reopen: full reserve coverage of circulating L-BTC, adoption of the updated Elements software, completion of security audits, and new key management arrangements.

Elements version 23.3.4, which addresses the flaw exploited in September, was released on September 9. An independent external audit of that version is still underway. Blockstream has not given a date for when withdrawals might resume, leaving holders of L-BTC without a clear timeline for when the token will again be fully redeemable for bitcoin.