Blockstream Pauses Liquid Network After 4,000 BTC Withdrawn in Exploit

On September 6, Blockstream announced that the Liquid Network, a Bitcoin‑based layer‑two sidechain, was paused after a vulnerability in its Elements software was exploited, resulting in the withdrawal of roughly 4,000 BTC (valued at about $320 million).

Exploit Details

The exploit was reported by the on‑chain analyst Ergo BTC and later confirmed by Blockstream’s atomic‑swap marketplace, SideSwap. According to SideSwap’s X post, a customer sent 4,000 L‑BTC to the peg‑out service at 14:05 UTC. The service burned the L‑BTC on Liquid and, at 14:28 UTC, the Liquid Federation transferred 3,996 BTC to the customer’s Bitcoin address. Blockstream identified the creation of the L‑BTC as a result of a bug in the Elements software.

Blockstream’s Response

Blockstream immediately paused the Liquid network and instructed exchanges to stop L‑BTC deposits and withdrawals. An on‑chain message asked the parties involved to contact [email protected]. The company also stated it is attempting to reach the “white‑hat” actors responsible for the exploit.

Community Reaction

Reactions on X were mixed. Some users criticized the software, while others noted the unusual communication method (contact via Signal) used by the alleged white‑hats, which differs from typical responsible‑disclosure practices.

Impact on Services

Samson Mow, CEO of JAN3 (developer of the Aqua wallet), indicated that the vulnerability appears related to Liquid’s Confidential Transactions at the node level, affecting Aqua’s Liquid functionality. Bitcoin transactions outside Liquid remain unaffected.

Broader Implications

The incident highlights ongoing security challenges for sidechains, bridges, and federated networks, especially as the crypto ecosystem faces multiple exploits in 2026. Discussions also referenced the possible role of large language models in identifying the bug, though Blockstream has not confirmed how the vulnerability was discovered.