Blockstream

Building the rails for Bitcoin finance. Enterprise, consumer, asset management.

The future of finance runs on ₿.

Support: @BlockstreamHelp

[Blockstream @Blockstream]

To those responsible for the theft of bitcoin from the Liquid Network:

Blockstream will not pay a ransom for the return of stolen funds. Taking assets without authorization and withholding their return is a crime, not responsible disclosure. It is not white-hat activity. It is theft.

We have engaged in good faith in an effort to secure the return of stolen user funds and protect the broader Bitcoin community. That effort should not be mistaken for acceptance of the actions taken nor of the terms being demanded.

We will not be a party to the precedent that open-source software developed for the good of the Bitcoin community should subject its developers to paying a ransom that far exceeds their economic participation.

Bitcoin is hard money and can’t be minted without costs, Bitcoin doesn’t haircut users to pay a ransom.

To the Bitcoin community:

We are fighting for what we believe in, for the users whose funds were taken, and for the principles on which Bitcoin was built.

The community has demonstrated incredible resolve with teams of people dedicating their time in support of each other to identify and patch vulnerabilities in each other's products and systems. We are all driven by the mission that Bitcoin is the single best asset, for every person, company, and institution on the planet to invest, use, and build on. The world is a different place with the advancements of AI, and the Bitcoin community has responded with force to combat that threat.

Damage has been done, battles have been lost, but on the whole the Bitcoin community is gaining ground in the war with bad actors.

We want to thank the community for those efforts, for your support in hardening the network, helping users recover funds, and for your support in our assertion that crime does not deserve rewards.

To those holding the stolen bitcoin:

There is still an opportunity to resolve this responsibly. The bitcoin can be returned and we can revert to the standard of white-hat principals.

However, if the funds are not returned, we will pursue every lawful avenue available to us. We will work with law enforcement, exchanges, service providers, forensic specialists, and other relevant parties to trace and recover the assets and identify those responsible.

More importantly, Bitcoin is transparent by design and the community is made up of the most sophisticated engineers, cryptographers, and white-hat hackers globally. Transactions do not disappear, and neither does the evidence they leave behind.

We will not pay for the return of stolen property. We will not abandon our users. The Bitcoin community will not stop pursuing the funds.

Return the bitcoin.

[Mifiel @mifielfirma]

Backing close to $5B+ USD in digital promissory notes (pagarés) on @Liquid_BTC, uptime is vital for us.
We began broadcasting our queued issuance transactions, and batches are clearing cleanly.
Huge credit to @Blockstream & all 15 functionaries for the quick recovery.

[Liquid Network 🌊 @Liquid_BTC]

LIQUID NETWORK UPDATE: TRANSACTIONS RESUMED, PEG-OUTS DISABLED
Status as of September 10, 2026, 19:55 UTC

Recovery Status

The Liquid Network has entered into its next recovery phase. Block production has resumed, and functionary nodes are signing and validating blocks. Transactions on the network have resumed, while peg-outs remain disabled as a precautionary measure while the final stage of recovery continues.

Rigorous testing, AI-assisted code scanning, and continuous network monitoring are underway by internal and external teams. Further information on the resumption of peg-outs will be shared once available.

Important: What You Should Know

Users do not need to take any proactive steps at this time. If you operate a Liquid node, please update to Elements v23.3.4 immediately.

Reminder: Beware of Scams

There are reports of scammers attempting to exploit the situation through fraudulent update sites and messages. Please rely only on official Liquid Network, Blockstream Jade, and Blockstream channels. Never send funds to unfamiliar addresses, transfer assets to unknown channels, or disclose private keys or seed phrases in response to unsolicited communications.

More Updates Soon

Updates will be shared through official Liquid Network and Blockstream channels. The Liquid Federation and Blockstream again sincerely thank the broader Bitcoin community for its continued assistance and support during this recovery.

[Liquid Network 🌊 @Liquid_BTC]

LIQUID NETWORK UPDATE: OPERATIONS RESUMED, RECOVERY ONGOING
Status as of September 10, 2026, 10:00 UTC

Recovery Status

The Liquid Network has entered the next phase of its controlled resumption. As a precautionary measure, block production has resumed without transactions while the network is monitored to confirm full stabilization.

Blockstream confirms that the required functionary and bridge node updates have been successfully deployed. Functionary nodes are signing and validating blocks as intended.

Peg operations, including PAK-authorized peg-outs, remain suspended while work continues on the final recovery stage: restoring the BTC/LBTC reserve is in progress.

Reminder: Beware of Scams

There are reports of scammers attempting to exploit the situation through fraudulent update sites and messages. Please rely only on official Liquid Network and Blockstream channels. Never send funds or disclose private keys or seed phrases in response to unsolicited communications.

Thank You

The Liquid Federation and Blockstream sincerely thank the broader Bitcoin community and security teams for their assistance and continued support during this challenging time.

Safely restoring full operations remains the highest priority.

[Blockstream @Blockstream]

Security Notice & Phishing Alert

Following the recent Liquid Network incident, scammers are impersonating Liquid and Blockstream and urging users to "take action." Don't.

Blockstream will never ask for your recovery phrase or PIN, ask you to send funds, or provide a link for updated software.

Never - Send funds to a "recovery" address
Never - Enter your seed on a "migration" site
Never - Install firmware or software from an email link
Never - Reply to unsolicited DMs

Treat as scams: "mandatory security update" emails and portals, refund / re-peg / "claim L-BTC" sites, fake support DMs, lookalike domains, and unsolicited "white-hat" or bounty outreach.

For verified updates, go only to https://t.co/7wsK5N5sVq or the official Blockstream app from the official app stores.

[Liquid Network 🌊 @Liquid_BTC]

LIQUID NETWORK UPDATE: NEW RELEASE
Status as of September 9, 2026, 13:30 UTC

Update to Elements v23.3.4

The emergency Elements v23.3.4 release is now available. Functionary nodes are being updated immediately and we recommend all Liquid node runners do the same. This release addresses the proof-verification cache vulnerability, hardening the cache keys used for range proofs.

Elements v23.3.4 has undergone multiple rounds of internal and external review, including by the Bitcoin Red Team, Alpen Labs and others. Blockstream sincerely thanks these teams for their valuable review and collaboration.

Liquid Network Recovery Plan

The recovery plan remains under active development and may be revised as testing and validation continue. Based on current assessments, the anticipated stages are:

1) Resume block production while peg operations remain suspended.

2) Replay transactions verified as valid.

3) Resume peg operations once the network state has been fully restored including a return of funds.

Blockstream is testing the procedures for the first two stages in parallel. While the current plan anticipates proceeding in the order above, the sequencing and implementation may be adjusted based on the results. No stage will proceed until it is considered safe to advance.

Beware of Scams

There are reports of scammers attempting to exploit this situation by misleading users with fake update sites. This is a reminder to only rely on official Liquid Network and Blockstream channels, and never send funds or disclose private keys or seed phrases in response to unsolicited messages.

We again thank the broader Bitcoin community and our research collaborators for their continued support and assistance. Safely restoring normal operations remains the highest priority for the Liquid Federation and Blockstream.

https://t.co/AqhLfbqYh4

[Liquid Network 🌊 @Liquid_BTC]

LIQUID NETWORK UPDATE: INCIDENT REPORT
Status as of September 8, 2026, 19:10 UTC

What Happened?

On September 6, 2026 at 15:53:10 UTC (Liquid block 4,050,336), a vulnerability in the open-source Elements software related to how Liquid nodes cache range proof verifications was exploited, resulting in the creation of ~4,000 LBTC that were not backed by bitcoin held in reserve.

The individual(s) responsible for the exploit then used the SideSwap service, a Liquid Federation member that holds a peg-out authorization (PAK) key, to convert the unbacked LBTC to BTC via Liquid’s standard peg-out mechanism. Because the validation failure occurred at the transaction level before the peg-out was initiated, both SideSwap’s node and the Liquid Network’s globally distributed functionary nodes accepted the LBTC as valid. The functionaries processed the peg-out as authorized, releasing approximately 4,000 BTC through SideSwap’s whitelisted bitcoin address, which SideSwap then forwarded to the address specified by the exploiters. Before the incident, the Liquid reserve held approximately 4,205 BTC. Following this peg-out and additional peg-outs processed before operations were halted, the reserve balance fell to 197 BTC.

Key Clarifications

No keys were compromised. The Liquid Federation functionaries were not hacked, and no private keys were compromised. The peg-out mechanism that authorizes withdrawals to whitelisted addresses operated as designed.

Other Liquid-issued assets were not affected. USDT and other tokens issued on the Liquid Network were not impacted by the vulnerability, though they are temporarily unavailable while the network remains paused.

Investigation is ongoing. As is common in complex critical-system failure investigations, this incident arose from the convergence of several individually low-probability factors that interacted in ways that ultimately defeated the system's built-in redundancies. More detail will be shared in forthcoming communications.

What Steps Have Been Taken To Recover The Assets?

The individual(s) responsible for the exploit left a public message on the bitcoin mainchain identifying themselves as white-hat security researchers and requesting contact to address the vulnerability.

Patch deployed. Blockstream identified and deployed a patch to the Liquid Network’s bridge nodes, which was completed on September 7 at 01:09 UTC, ensuring the vulnerability is no longer exploitable.

Partial fund recovery. On September 7 at 16:09:25 UTC (Liquid block 965,950), the exploiters returned 3,400 BTC to the Liquid Federation peg wallet. Approximately 598.5 BTC (15% of the total) remains outstanding. Discussions between Blockstream and the individuals responsible are ongoing to secure the return of the remaining funds.

What Comes Next?

Our immediate priorities are recovering the remaining funds and resuming normal network operations safely and as quickly as possible.

Software update in progress. A fix for the exploited vulnerability has been developed and is undergoing multiple rounds of internal and external review. Blockstream is preparing an emergency release of Elements (v23.3.4), which is expected to be released as soon as possible, but within approximately 48 hours.

Network restoration. Once the software update is finalized, Liquid Network functionary operators will perform additional adjustments to resume full functionality and restore the corrected network state, including rejection of the invalid peg-out.

Ongoing updates. We will continue to provide detailed updates as the situation progresses.

What You Should Know

The Liquid Network remains offline at this time, while we work on reviewing the security fixes and network resumption code and coordinate with the white hat hacker towards timely resumption of the network with 1:1 backing for BTC. While the network is paused, users cannot transact on Liquid. If you operate a Liquid node, please watch for the emergency Elements release and follow the upgrade instructions when available. Users do not need to take any proactive steps to protect their funds at this time.

The Liquid Federation and its members are committed to resolving this incident in coordination with Blockstream and to resuming normal operations as soon as it is safe to do so.

[Blockstream @Blockstream]

Following the recent incident affecting the Liquid Network and the movement of funds, Blockstream, as Liquid’s technical provider, and the Liquid Federation have been working diligently to resolve the ongoing situation and ensure the return of assets.

Updated software has been deployed as the Federation members prepare the network for a coordinated restart. Our teams remain focused on further hardening the network.

We want to thank the broader Bitcoin community for their patience, support, advice, and assistance throughout this process.

We will continue to provide updates as progress is made.

[Blockstream @Blockstream]

@BlockstreamJade Does this count as a 'reply'?

[Blockstream @Blockstream]

We have been testing Blockstream Swaps. It is going well, and a lot of you asked to get in.

Request beta access:
https://t.co/zpT6u35eXv

[Blockstream @Blockstream]

https://t.co/4xae4o4eKl

[Blockstream @Blockstream]

Stay the course. Don't rebalance. Get your Bitcoin into self-custody

https://t.co/d4IUzLeUpQ

[Blockstream @Blockstream]

2% allocation. If Bitcoin doesn't perform, the portfolio recovers. If it continues toward $200T, the effect is outsized.

@adam3us on why pension funds don't need to form an opinion on how far Bitcoin goes, just stay the course and don't rebalance.

[Blockstream @Blockstream]

https://t.co/yHuAWXHN0o

[Blockstream @Blockstream]

Finding the right post-quantum signature for SHRINCS meant testing 25,935 parameter sets.

@blksresearch built an open-source explorer where wallet developers, protocol researchers, and anyone else set the weights that match their case.

Full post: https://t.co/65Jy60QQOc

[Blockstream @Blockstream]

https://t.co/CNOfN4sVbn

[Blockstream Jade @BlockstreamJade]

Jade air-gapped QR support is new in the @Blockstream desktop app.

Run Jade Plus fully air-gapped and the device never touches your computer. PIN unlock, wallet import, address checks and signing all happen over QR codes, read by the camera on the device.

[Blockstream @Blockstream]

https://t.co/AwRk25T5Uw has been rebuilt, for Bitcoin and @Liquid_BTC.

Watch the next block fill. Read real analysis on any transaction. Check Liquid's backing yourself, in one dashboard. Everything new:

https://t.co/WtPm7Xbbep

[Core Lightning ⚡️ @Core_LN]

Core Lightning 26.06.7 is out and recommended for every node runner.

It fixes vulnerabilities reported over the past three weeks, during a sharp rise in AI-generated reports across open source Bitcoin. Details stay under embargo for two weeks, then all published.

https://t.co/Ygw1VkLkoV

[Blockstream @Blockstream]

OP_CHECKSHRINCS in full, from @blksresearch:

https://t.co/VXaptFV383

[Blockstream @Blockstream]

Quantum-ready Bitcoin in practice:

To get ready, you send to a new Taproot address. With OP_CHECKSHRINCS by @blksresearch, it holds a Schnorr key and a post-quantum key. You keep spending with Schnorr at today's cost. When a quantum computer arrives, you spend with the post-quantum key.