Liquid Network Restarts Block Production After $320M Theft; Peg-Outs Remain Disabled

Liquid Network is gradually coming back online after an attack that siphoned roughly $320 million from its federation wallet. Block production has resumed, with functionary nodes again signing and validating blocks. On 10 September, the network restarted block production while keeping transactions switched off at first. Later that evening, transaction processing was re-enabled, allowing users to move assets already on Liquid. Transactions were paused during an initial monitoring period as operators checked stability. Key parts of the recovery are still outstanding. Peg-outs remain disabled—the mechanism that lets users move LBTC from Liquid back to the Bitcoin (BTC) network in exchange for BTC. As a result, users can transact within Liquid but cannot withdraw LBTC to the Bitcoin main chain via the standard peg-out flow. Blockstream has said the restriction is deliberate to reduce risk and prevent a repeat incident, and is expected to keep peg-outs off until it is satisfied with the network's internal state and has verified that BTC/LBTC reserves are properly restored. The heightened caution follows a proof verification cache vulnerability in Liquid's underlying Elements software. Blockstream released Emergency Elements v23.3.4 to address the issue by strengthening the cache keys used during range-proof verification. Blockstream also stated it "will not pay a ransom for the return of stolen funds," arguing the incident was theft rather than legitimate "whitehat" activity. The company said it had attempted to negotiate in good faith but will now work with law enforcement, exchanges, blockchain investigators, and security specialists to trace and recover the stolen BTC. The update comes as AMBCrypto reported that recovery efforts improved after white-hat hackers returned 3,400 BTC, valued at about $268 million. That implies roughly 85% of the Bitcoin taken in the incident has been restored. About 598.5 BTC remains held in a separate wallet as an unofficial bounty. Summary: Liquid restarted block production on 10 September, initially leaving transactions disabled. Recovery steps have been rolled out cautiously in response to the proof verification cache vulnerability, and peg-outs are still frozen.