Blockstream said an Elements bug let someone take nearly 4,000 bitcoin from the Liquid Network on September 6, then return 3,400 bitcoin the next day, leaving about 598.5 bitcoin unreturned while the network stays paused. Liquid backs its L-BTC token with real bitcoin, so the incident hit the reserve that supports redemptions, not just a single wallet.
The flaw sat in Liquid’s sidechain software, not in the release keys: SideSwap and Blockstream both said the Peg-out Authorization Key was not compromised, and the bug let the system accept a peg-out it should not have approved. That means the attacker could trigger a real bitcoin release by making the protocol believe the withdrawal was valid.
For operators and desks that hold L-BTC, the important exposure is still the same after the partial return: redemptions remain frozen until the federation restarts the network. The leftover bitcoin also leaves open a separate question the reporting does not settle — whether the return was a negotiated settlement or just change from the original transaction.