The Liquid Network has resumed block production following a Bitcoin withdrawal worth approximately $320 million, but transactions and peg operations remain suspended as recovery efforts continue.

In a Thursday post on X, Liquid said block production had restarted “without transactions” as a precaution while the network is monitored to “confirm full stabilization.” Required updates have been deployed to the network’s functionary and bridge nodes, and functionary nodes are now signing and validating blocks as intended. The restart is therefore a limited recovery step rather than a full reopening, with users still unable to transact while the network is monitored.

Peg operations, including PAK-authorized peg-outs, remain suspended while Liquid works to restore its BTC/L-BTC reserve. The next operational milestones are the resumption of transactions and peg operations, alongside continued monitoring and reserve-recovery work.

On Wednesday, Liquid released an emergency update to Elements, the open-source software underlying the network, to address the proof-verification cache vulnerability linked to the incident. Elements v23.3.4 hardened the cache keys used for range proofs as part of the recovery plan.

$270 million in Bitcoin returned after exploit

Liquid paused operations on Sept. 6 after actors claiming to be white-hat hackers withdrew about 4,000 Bitcoin (BTC), worth roughly $320 million, from the network’s federation wallet.

The withdrawal represented approximately 95% of the wallet’s roughly 4,200 BTC balance and involved L-BTC originating from a bug in Elements.

The actors later returned 3,400 BTC, worth about $270 million at the time, after Blockstream confirmed that the affected bridge nodes had been patched. About 598 BTC, worth roughly $46 million at current prices, remained outstanding as of Sept. 7.

Liquid provided a further update in a post on X.