Liquid Network

Liquid Network is a Bitcoin sidechain and layer-2 settlement network that issues digital assets and enables faster, confidential transfers on top of the Bitcoin blockchain. It was launched in 2018 by Blockstream, which continues to serve as the network's technology provider.^[1]​^[2]

The network is designed to address the slow settlement speed of the Bitcoin blockchain for exchanges by locking bitcoin in reserve and issuing a corresponding asset, L-BTC, that can settle trades more quickly.^[1] It presents itself as "The Financial Layer for Bitcoin Capital Markets."^[3]​

Liquid is overseen by a federation of more than 80 exchanges, infrastructure firms and asset managers, and supports the issuance of a range of digital assets including stablecoins, security tokens and other financial instruments. The network reports a total value locked of approximately $5 billion. ^{[1] [2] [3]}​

Overview

Liquid Network functions as a companion chain to Bitcoin rather than a replacement for it. Bitcoin is locked in reserve, and the network issues L-BTC against those reserves, allowing trades and transfers to settle faster than they would on the base Bitcoin blockchain.^[1]

The network is categorized as both infrastructure and layer-2, and it supports fast, confidential settlement alongside the issuance of digital assets.^[2]​

The network reports an average fee rate of 0.1 satoshis per virtual byte (sat/vB), a low-cost profile intended to make frequent settlement and asset transfers economical for institutional users.^[3]​

Movement of value between Bitcoin and Liquid occurs through a two-way peg, in which users lock bitcoin to receive L-BTC (a "peg-in") and later redeem L-BTC for bitcoin (a "peg-out").

September 2026 Exploit

On 7 September 2026, Liquid Network paused operations after actors claiming to be white-hat hackers withdrew roughly 4,000 bitcoin, valued at about $320 million, from the federation wallet.^[5]​^[1]

The amount represented approximately 95% of the federation wallet's balance, which had held about 4,200 BTC before the incident.^[5]​

​Blockstream attributed the incident to a software bug in Elements rather than to compromised passwords or private keys, stating that the bug had created some of the bitcoin involved.^[1]

Security specialists quoted at the time identified the flaw as residing at the node level in Liquid's transaction software rather than as a breach of keys or hardware security modules.^[1]

The stolen funds moved out through SideSwap, described as a normal and approved trading platform on Liquid. SideSwap said the withdrawal passed through its peg-out service as a customer order using its PAK, that the key was not compromised, and that the L-BTC originated from a bug in Elements rather than from SideSwap's own systems. Because SideSwap could not distinguish which coins came from the Elements bug and which were genuine, it treated all coins the same.^[5]​^[1]​

In response, bridge nodes on Liquid were disabled to prevent new transactions, and exchanges had halted or were preparing to halt L-BTC deposits and withdrawals while the sidechain remained paused and federation members worked to fix the vulnerability.^[5]

Liquid stated on X that "Liquid wallets will be impacted, and we're sorry for any inconvenience," adding that "Federation members are actively working on resolving this so we can restore normal network activity."^[1] Liquid said that other assets issued on the network, including USDT, DePix and real-world assets, were unaffected.^[5]​^[1]​

The actors communicated with network maintainers through signed on-chain Bitcoin transactions, promising to return most of the funds once the vulnerability was fixed. In one reproduced on-chain message they wrote: "Please fix the bug first. The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix."^[1]

Blockstream began contacting the actors through signed on-chain messages, and the actors told Blockstream to patch the Elements vulnerability and ensure every node was updated before returning the bitcoin.^[5]

The actors reportedly sent encrypted technical details to Blockstream, a detail attributed to Alex Thorn, head of research at Galaxy Digital.^[5]

As of the reporting on 7 September 2026, the funds had not been returned, and Liquid had not said when the network would reopen or whether the bitcoin would be recovered.^[5]​^[1]​

Elements and Technology

Liquid runs on Elements, an open-source blockchain platform maintained in the ElementsProject/elements repository on GitHub. The repository was created on 8 June 2015 and describes Elements as an "open source, sidechain-capable blockchain platform" and as "the integration and staging tree for the Elements blockchain platform, a collection of feature experiments and extensions to the Bitcoin protocol."^[4] Elements is written primarily in C++, with substantial portions in C and Python, and is released under the MIT License.^[4]​

Elements enables anyone to build businesses or networks pegged to Bitcoin as a sidechain, or to run a standalone blockchain with arbitrary asset tokens.^[4]

The software supports multiple operating modes selected by command-line arguments: Liquid mode, which syncs with the Liquid network, is run with elementsd -chain=liquidv1. It also supports Bitcoin mainnet (-chain=main, not intended for commerce), Bitcoin testnet (-chain=testnet3), Bitcoin regtest (-chain=regtest), and custom Elements chains through any other -chain= argument, which start with regtest-like default parameters that can be overridden at startup.^[4]​

Features

Elements extends the Bitcoin protocol with several features not present in Bitcoin itself:

• Confidential Assets, the ability to issue multiple assets on a blockchain where asset identifiers and amounts are blinded yet remain auditable through applied cryptography.^[4]
• Confidential Transactions, which conceal transaction amounts.
• Federated Two-Way Peg, the mechanism by which value moves between Bitcoin and the sidechain.
• Signed Blocks, a block-production model relying on designated signers rather than open mining.
• Additional opcodes beyond those available in Bitcoin.^[4]

A Confidential Assets whitepaper was presented on 7 April 2017 at Financial Cryptography 2017 in Malta, accompanied by an announcement, a tutorial and a demonstration.^[4]

Some features first developed in Elements were later integrated into Bitcoin itself, including Segregated Witness and Relative Lock Time, while Schnorr Signatures were deferred for additional research and standardization.^[4]​

Assets and Use Cases

Liquid is used to issue and settle a range of financial instruments, and the network reports a cross-section of digital assets held on it.

Among the largest reported holdings are $2.1 billion in Mifiel promissory notes and $877 million in BMN2, alongside $97 million in the Tether stablecoin (USDT), $32 million in USTBL, $15 million in the Aquarius Fund, $7.4 million in CMSTR and $7 million in MEXAS.^[3]

These holdings reflect Liquid's positioning around stablecoins, tokenized securities and real-world assets.^[2]​

Federation and Governance

Liquid is governed by a federation of more than 80 members, comprising exchanges, infrastructure firms and asset managers.^[1]

The federation collectively administers the two-way peg and produces the network's signed blocks, and its members hold the bitcoin reserves that back L-BTC in a federation wallet. During disruptions, federation members are responsible for restoring normal network activity.^[1]​

Peg-outs from Liquid can be executed through approved trading platforms on the network. SideSwap, one such platform, uses a Peg-out Authorization Key (PAK) to process peg-out orders as customer transactions.^[5]​