Liquid Network is producing blocks again, and SideSwap has reopened markets and new peg-ins. But the recovery is incomplete: peg-outs remain disabled, approximately 598.5 BTC has not been returned, and public figures on September 11 showed less bitcoin in the federation reserve than L-BTC in circulation.
The cautious restart follows a September 6 consensus failure in Elements, the open-source software underpinning the Bitcoin sidechain. According to SideSwap’s detailed incident statement, the bug allowed an unidentified party to create roughly 4,000 L-BTC without depositing the corresponding bitcoin. The party then used SideSwap’s peg-out service, causing the Liquid Federation to release approximately 3,996 BTC on Bitcoin’s main chain.
Most of those coins came back. Blockchain records and TRM Labs’ incident analysis show about 3,400 BTC was returned on September 7, or roughly 85% of the amount withdrawn. The people controlling the funds called themselves white hats; their identity and motive remain unverified, and about 598.5 BTC was still outstanding in the latest public accounting.
This was not a compromise of Bitcoin’s base-layer protocol. It was a failure in a separate system designed to move value between Bitcoin and Liquid—a distinction that matters because users are now facing different states at once: the sidechain is processing transactions, trading has resumed, deposits can enter, but withdrawals through the federation peg cannot leave.
What is open on Liquid Network now?
Liquid resumed producing blocks on September 10. SideSwap said its swaps and markets reopened with the network, while wallets, keys and token balances remained under their owners’ control. On September 11, the service reopened peg-ins, allowing users to deposit BTC and receive L-BTC at a one-to-one issuance ratio, less SideSwap’s standard 0.1% fee.
Peg-outs are still closed both at SideSwap and at the federation bridge nodes. That means L-BTC cannot currently be redeemed for BTC through the normal federation process. SideSwap says the restriction will remain while the Liquid Federation completes its security review; Blockstream has not published a firm reopening time.
| Liquid function | Status checked September 12 | Practical meaning |
|---|---|---|
| Block production | Running | Liquid transactions can confirm again |
| SideSwap markets and swaps | Open | L-BTC and other Liquid assets can trade at market prices |
| Peg-in | Open at SideSwap | BTC can enter Liquid and create new L-BTC |
| Peg-out | Closed | L-BTC cannot yet be redeemed through the federation for BTC |
The reserve gap is the key number
SideSwap cited the Liquid network’s public data as showing 4,229 L-BTC in circulation against 3,627 BTC in the federation reserve on September 11. That is a visible difference of 602 BTC. It is close to—but not identical with—the approximately 598.5 BTC still held by the party behind the withdrawal, so the two figures should not be treated as interchangeable without a complete reconciliation.
Blockstream CEO Adam Back has said publicly that the peg will be covered one-to-one, according to SideSwap. The mechanism, funding source and timetable have not yet been announced. Until peg-outs resume and the reserve position is reconciled, a promise to restore backing is not the same as an immediately exercisable redemption.
Reopening peg-ins does not, by itself, erase the existing difference. Each new BTC deposit creates new L-BTC at the stated issuance ratio, so both sides of the accounting rise together. SideSwap explicitly cautioned that users without an immediate need for L-BTC may prefer to wait until peg-outs and full backing are restored.
How unbacked L-BTC became real bitcoin
Liquid normally works through a two-way peg. A user locks BTC with the federation and receives L-BTC on Liquid. To exit, L-BTC is destroyed and the federation releases the corresponding BTC on Bitcoin. The model depends on Liquid nodes agreeing that the sidechain asset being burned is valid and properly backed.
On September 6, the Elements bug broke that assumption. SideSwap says the attacker spent hours sending 70 rehearsal transactions before a final transaction created approximately 4,000 L-BTC from nothing. The newly created tokens were deposited into SideSwap’s peg-out service and burned with a valid authorization. Eleven of 15 federation signers then approved the release of about 3,996 BTC.
SideSwap says no private key was compromised. That is not an all-clear. The service acknowledged that its peg-out authorization key was online, payouts were automated, and the pipeline lacked size, velocity and wallet-history checks. A withdrawal representing a large share of all outstanding L-BTC passed without human review.
The distinction between a stolen key and a consensus bug is important. Multisignature security can protect against unauthorized signing, but it cannot save a bridge if its signers approve a withdrawal based on invalid chain state. In this case, the signatures worked as designed after the software had already accepted unbacked tokens as real.
The disclosure timeline raises a second question
SideSwap’s account says developers wrote a fix for the underlying bug on August 3 and shared a security build privately with Liquid members on August 12. SideSwap says it deployed that build the next day, but it did not prevent the exploit. The fix was then merged into the public Elements repository on September 1 under a title describing the vulnerability, while no public software release yet contained the correction.
Those dates are SideSwap’s account and may be refined by a full postmortem. Even so, they spotlight a familiar open-source security problem: once a patch reveals a vulnerability, the time between public disclosure and broad deployment can become an attack window. The episode also shows why operational controls—withdrawal caps, delays and manual review—matter when a software fix is incomplete or unevenly deployed.
What Liquid users should watch next
The most important milestone is not block production. It is the safe return of peg-outs with a verifiable one-to-one reserve position and disclosed controls around large withdrawals. Users should look for a federation-level reconciliation, the terms of any replacement for the missing BTC, and a technical postmortem explaining which versions were vulnerable and how the final patch was validated.
SideSwap has promised to explain changes to its authorization-key custody, payout limits and checks before reopening its own peg-out service. Blockstream’s public status page should also show the bridge-node recovery. Until then, “network running” and “peg fully restored” describe two different conditions.
Quick answers
Was Bitcoin itself hacked?
No. The incident affected Elements and Liquid’s peg mechanism, not Bitcoin’s base-layer consensus.
Can L-BTC be redeemed for BTC now?
Not through the federation peg as of the latest verified updates. Peg-outs remain disabled even though blocks, markets and SideSwap peg-ins have resumed.
Were all withdrawn coins returned?
No. About 3,400 BTC was returned, while approximately 598.5 BTC remained outside the federation reserve in the latest public reporting.
Are the actors confirmed white hats?
No. They described themselves that way, but their identity and intentions have not been independently verified.
Sources checked September 12, 2026: SideSwap incident and recovery notices, Blockstream service status, Liquid public network figures, Bitcoin transaction records summarized by TRM Labs, and contemporaneous Reuters reporting. Featured illustration by Joshua Woroniecki/Unsplash. This report contains no affiliate links and is not investment advice.
Investment disclaimer: This article is provided for general information only and does not constitute investment, financial, legal or tax advice. Digital assets are volatile, and all investment decisions and their consequences are your own responsibility.