Nearly 4,000 Bitcoin, worth approximately $320 million at the time, were withdrawn from the Liquid Network's federation wallet on September 6th, according to Blockstream, the network's technology provider.

A user submitted L-BTC to SideSwap's peg-out service at 14:05 UTC, and the federation transferred approximately 3,996 Bitcoin to the recipient's Bitcoin address 23 minutes later, at 14:28 UTC.

Blockstream identified the flaw as a proof-verification cache vulnerability in the cache keys used for range proofs within Elements, Liquid's underlying software, unrelated to the network's authorization keys or hardware security modules.

JAN3 CEO and Liquid Network Technology Board member Samson Mow posted an update on Liquid Network's recovery efforts.

Federation members disabled Liquid's bridge nodes to pause the sidechain, and exchanges suspended L-BTC deposits and withdrawals while Blockstream investigated.

Liquid Network reported that 3,400 of the roughly 4,000 Bitcoin taken were returned to the federation wallet on September 7th, after Blockstream confirmed the affected bridge nodes had been patched.

Approximately 598 Bitcoin remained outstanding, held in a Bitcoin address published for public monitoring.

The network stayed paused for additional fixes, to resolve a resulting chain split, and to prepare for a safe restart.

On September 9th, Liquid Network released Elements v23.3.4, an emergency patch addressing the vulnerability, which it said had been reviewed by the Bitcoin Red Team, Alpen Labs, and other outside teams before release.

Liquid Network outlined a three-stage recovery plan: resuming block production while peg operations stayed suspended, replaying transactions verified as valid, and resuming peg operations once the network's Bitcoin reserve was fully restored.

Blockstream co-founder and chief executive Adam Back said it had "been a busy few days" as the security release and resumption plan came together.

By then, the party holding the outstanding Bitcoin had demanded a ransom of 400 Bitcoin, roughly 10 percent of the nearly 4,000 Bitcoin originally taken, for the return of the remaining funds.

Blockstream sent the holder two encrypted, PGP-signed messages over the Bitcoin network, on September 9th and September 10th.

The September 9th message, signed by security@blockstream.com and mined about 26 minutes after signing, ran roughly 2.8 kilobytes, about three times the length of Blockstream's earlier messages.

The September 10th message, sent the next day, ran about 1.5 kilobytes and drew no reply from the holder.

On September 10th, Liquid Network said block production had resumed without processing transactions while the network was monitored for stability, and that the required functionary and bridge node updates had been successfully deployed.

Peg operations, including PAK-authorized peg-outs, remained suspended while the Bitcoin reserve backing L-BTC was restored, Liquid Network said.

Back wrote the same day that the LBTC to Bitcoin peg would be covered, telling users the answer to whether it would hold was "YES" while further system updates were completed before peg-ins and peg-outs could resume.

Blockstream publicly rejected the ransom demand on September 11th, stating it would not pay a ransom for the return of stolen funds.

The company distinguished a ransom, which it called a crime, from a bounty, which it said must be offered rather than demanded by whoever holds the stolen funds.

"We will not pay for the return of stolen property. We will not abandon our users," the company stated.

Blockstream said it would work with law enforcement, exchanges, and forensic specialists to "trace and recover the assets and identify those responsible" if the funds were not returned, closing with a direct appeal: "Return the Bitcoin."

By September 15th, Blockstream developers were still hardening Liquid's security and running additional testing, work that needed to be finished properly before peg-outs could resume.

Liquid Network stated that the L-BTC to Bitcoin peg will return to a 1:1 ratio once developers confirm peg-outs are safe to resume.

AQUA Wallet, the JAN3-built Liquid wallet, reported the same day that native Bitcoin on-chain transactions, Liquid-to-Liquid transfers, and peg-ins via SideSwap were fully operational again.

Liquid USDT cross-chain swaps were available through SideShift AI, and swaps between Liquid and Lightning remained only partially restored.

Peg-outs stayed suspended pending the security hardening, and as of September 16th, Liquid Network's own site still listed issued-asset transfers as resumed while L-BTC transfers and peg-outs remained paused.

Liquid Network lists roughly $5 billion in total value locked on the sidechain, including individual issued assets such as $2.1 billion in Mifiel promissory notes, $877 million in BMN2, and $97 million in USDT, according to the network's own published figures.