EL7.AI
CryptoMediumUpdated•Originally published 7 September 2026•Updated 7 September 2026•
2 min read

Liquid Pauses Transactions After About 4,000 BTC Withdrawal Tied to Elements Bug

Key Facts

1About 4,000 BTC was withdrawn from a wallet that held about 4,200 BTC, equivalent to roughly 95% of its reported balance.
2A party sent 4,000 L-BTC to SideSwap at 14:05 UTC, and the Liquid Federation paid about 3,996 BTC at 14:28.
3L-BTC is intended to be backed 1:1 by BTC held by the Liquid Federation.

Liquid halted new transactions on September 6 after about 4,000 BTC was withdrawn from the federation wallet backing L-BTC. The network disabled bridge nodes and asked exchanges to stop L-BTC deposits and withdrawals, while the actors described themselves as white hats without independent confirmation of their identity or intentions.

SideSwap said a customer sent 4,000 L-BTC to its peg-out service at 14:05 UTC. The tokens were burned under a valid authorization before the Liquid Federation paid about 3,996 BTC at 14:28 UTC. SideSwap said Blockstream determined that the L-BTC used in the request had been created through an Elements software bug, rather than a compromise of the PAK authorization key or SideSwap’s systems.

Liquid’s documentation says every L-BTC is intended to be backed 1:1 by BTC held in the federation wallet. In a normal peg-out, L-BTC is burned and the federation releases the equivalent BTC on the Bitcoin network. The incident therefore concerns the pegged asset’s issuance and redemption rules, not a compromise of Bitcoin’s base protocol.

The wallet held about 4,200 BTC before the incident, making the roughly 4,000 BTC withdrawal equivalent to about 95% of its reported balance. The funds had not been returned when the inspected sources were prepared, leaving L-BTC backing and redemption exposed until the coins are recovered or the reserve is reconciled.

The party controlling the funds told Blockstream through messages recorded on Bitcoin that it would return most of the coins after the vulnerability was fixed and every node installed the update. That pledge neither verifies the actors’ white-hat status nor guarantees recovery, and the public exchange does not establish that a repayment agreement has been completed.

Liquid said other assets issued on the network, including USDT, DePix and tokenized real-world assets, were not directly affected. The decisive next indicators are the return of the funds, publication of a final technical analysis, restoration of bridge nodes and resumption of L-BTC deposits and withdrawals; no detailed public root-cause report had been released at the time of reporting.