Liquid Keeps Bitcoin Redemptions Suspended With 600 BTC Unreturned

Liquid Network continues to block Bitcoin redemptions after a software exploit released nearly 4,000 Bitcoin (BTC), with about 600 BTC still unreturned and full reserve backing required before peg-outs resume.

The Sept. 6 incident created approximately 4,000 unbacked Liquid Bitcoin (LBTC). Invalid LBTC was created at 11:53:10 a.m. ET (15:53:10 UTC), while 3,996.02 BTC was released on the Bitcoin network at 10:28:56 a.m. ET (14:28:56 UTC). Nearly all of the released BTC was sent to an address controlled by the exploiter.

The attacker returned 3,400 BTC on Sept. 7. As of Sept. 8, approximately 598.5 BTC, or 15% of the total withdrawn, remained unreturned. A later update described the balance as approximately 600 BTC.

The incident involved a vulnerability in Elements software, not the theft of private signing keys. Invalid LBTC passed validation before the peg-out authorization process released BTC from Liquid’s Federation reserve.

Liquid released Elements v23.3.4 on Sept. 9 to address the proof-verification cache vulnerability and strengthen cache keys used for range proofs. Block production and regular user transactions resumed Sept. 10, but peg-outs remained disabled.

“peg-outs will resume only after full 1:1 BTC backing for LBTC has been confirmed,” Liquid said in a Sept. 17 ecosystem update.

Liquid was working through the stated audit, testing and key-management requirements as of the latest available updates. An independent external security audit of Elements v23.3.4 was underway as of Sept. 28, while the Liquid Federation was replacing entries in its Peg-out Authorization Key list and securing peg-out keys in cold storage.

A peg-out burns LBTC and releases an equivalent amount of BTC from the Federation’s reserve. Liquid has not provided a firm date for restoring the service. The suspension follows earlier coverage of the redemption freeze.