Liquid users can see blocks moving again without having full access to the network’s central promise: converting L-BTC back to bitcoin. BTC-Pulse reported that peg-outs remained frozen after a September security incident left part of the federation reserve unrecovered. Blockstream’s own material supports the operational warning, although its accounting uses about 602 BTC outstanding rather than the donor article’s roughly 603 BTC.
What failed
Blockstream’s incident assessment says an attacker exploited a flaw in the Elements rangeproof verification cache on September 6. The faulty cache key allowed one transaction with output value unsupported by its inputs to pass validation. That transaction created about 4,000 unbacked L-BTC, which then moved through the normal peg-out path. Federation signers released 3,996.02 BTC on Bitcoin’s main chain before Liquid halted its bridge nodes.
The attacker later returned 3,400 BTC. Blockstream’s assessment lists approximately 602 BTC as still outstanding at the time of the report. Liquid uses 15 federation functionaries and requires signatures from at least 11 to accept a block. In this incident, the weakness sat in transaction validation rather than the signature threshold. The company deployed an interim patch, followed by the reviewed Elements 23.3.4 release. Those software fixes address the validation flaw. They do not, by themselves, replace the missing bitcoin or restore every user operation.
Why a running chain is not full recovery
Liquid’s official incident page separates block production from peg operations. Its latest posted update, dated September 10, says functionary and bridge-node updates had been deployed and block production had resumed without transactions during monitoring. The same update says peg operations, including authorized peg-outs, remained suspended while work continued to restore the BTC/LBTC reserve.
That distinction changes what users should verify. A block explorer showing new blocks proves that functionaries are producing and signing blocks. It does not prove that an L-BTC holder can redeem at par on demand. Exchange deposits, withdrawals and secondary-market trading can also recover on different schedules. Each route needs its own status check.
A practical check before moving funds
Start with the official incident page rather than social posts or copied status summaries. Confirm whether peg-outs are enabled, then check the wallet or exchange that will receive the bitcoin. If a venue accepts L-BTC deposits but cannot complete a peg-out, the user still carries venue, liquidity and redemption risk.
For larger transfers, a small test can confirm that the chosen route is accepting transactions, but it cannot prove reserve sufficiency or guarantee later redemption. Users should also record any quoted fee, expected settlement time and withdrawal condition before committing funds. The decisive recovery signal is an official notice that peg operations have resumed after reserve restoration, followed by successful redemption through the route the user intends to use.
Source: BTC-Pulse.