Liquid Network Restarts Block Production After $320M Bitcoin Exploit, Pegs Remain Suspended
Key Takeaways
- •Liquid Network resumed block production on September 10, 2026, as a precautionary measure following an incident in which approximately 4,000 BTC, worth around $320 million, were withdrawn from its federation wallet.
- •The network is generating blocks without processing transactions, and both peg-ins and PAK-authorized peg-outs remain disabled while recovery continues.
- •Blockstream deployed emergency software fixes and updated all functionary and bridge nodes, which have now resumed signing and validating blocks.
- •Full restoration of services depends on restabilizing the BTC/LBTC reserve and confirming infrastructure stability, and Liquid did not provide a new estimate of how many bitcoins remain unclaimed.
- •Liquid warned users about fraudulent websites and messages impersonating recovery efforts, advising reliance on official channels only and never sharing funds, private keys, or seed phrases.

Liquid Network has resumed block production following emergency updates after an incident involving about 4,000 BTC, valued at approximately $320 million, was pulled from its federation wallet. However, the network is producing blocks without transactions, and both peg-ins and peg-outs remain suspended while the BTC/LBTC reserve is recovered and the infrastructure is monitored.
The controlled recovery means users cannot yet transact or move bitcoin through Liquid’s peg system. Liquid said on September 10 that restarting block production was a precautionary step intended to allow operators to observe network behavior before normal activity is restored.
LIQUID NETWORK UPDATE: OPERATIONS RESUMED, RECOVERY ONGOING Status as of September 10, 2026, 10:00 UTC Recovery Status The Liquid Network has entered the next phase of its controlled resumption. As a precautionary measure, block production has resumed without transactions while… — Liquid Network 🌊 (@Liquid_BTC) September 10, 2026
Blockstream has updated all of Liquid’s functionary and bridge nodes. Functionary nodes have resumed signing and validating blocks, marking a further step in the recovery process. The restart does not mean that the network has returned to full operation: transaction activity remains limited while operators verify the stability of the network infrastructure.
All peg-related operations are disabled. This includes PAK-authorized peg-outs, which are used to transfer assets from Liquid back to the Bitcoin network. Peg-ins, which move bitcoin into Liquid, also remain suspended during the recovery process.
The practical recovery milestones are the restabilization of the BTC/LBTC reserve, continued confirmation that the upgraded infrastructure is stable, and the eventual restoration of transaction and peg functions. Until those steps are completed, resumed block production should not be treated as a return to normal Liquid operations.
BTC/LBTC Reserve Recovery Remains the Priority
The next phase of the recovery focuses on restoring the asset backing for Liquid’s Bitcoin-based asset, L-BTC. Liquid’s update did not provide a new estimate of how many bitcoins remain unclaimed from the incident. Earlier indications were that approximately 4,000 BTC had been pulled from the federation wallet, which held the majority of the wallet’s assets.
The incident prompted Liquid and Blockstream to deploy emergency software fixes before restarting part of the Liquid Network. Their response has focused on securing the infrastructure and preventing the vulnerability used in the exploit from being reused.
Liquid’s recovery follows the earlier suspension of network operations after the incident. Block production has now resumed under restricted conditions, but transactions and Bitcoin peg operations remain offline. Full functionality will depend on completing the reserve’s restabilization and obtaining additional confirmation that the network infrastructure has stabilized.
Liquid Warns Users About Recovery Scams
Liquid has also warned users about fraudulent websites and messages attempting to exploit the recovery process. The network said scammers were using fake updates and purported recovery attempts to take advantage of the incident, and recommended relying only on official Liquid Network and Blockstream channels.
Liquid previously advised users not to send funds, private keys, or seed phrases in response to unsolicited messages. The warning is particularly important while peg operations are suspended, as users may encounter false promises involving the restoration of withdrawals or recovery services.
Security researchers and members of the broader Bitcoin community have helped with the response. Liquid and Blockstream congratulated those who contributed to the restoration process while emphasizing the importance of maintaining network security.
The post-incident recovery remains staged: the blockchain is generating blocks under limited conditions, node infrastructure has been upgraded, and transaction and Bitcoin peg functions are still unavailable.