Liquid Network incident: on-chain transfers are paused

Executive Summary

On 6 September, ~4,000 BTC (~USD 320m) was withdrawn from the Liquid federation's bitcoin peg wallet via SideSwap's peg-out interface; Liquid states no federation keys were compromised. The party, self-described white hats, has offered on-chain to return most of the funds once a vulnerability is patched. Blockstream confirmed today by a signed message that nodes are patched and the funds can be returned.

STOKR impact is limited to network availability. Digital securities holdings are intact. Digital securities balances are visible and correct in holders' wallets, and no unauthorised issuance of any STOKR-issued asset has taken place. The issuance registry and ownership records of digital securities issued as AMP assets on the Liquid Network are unchanged. The impact is limited to on-chain movements. The Liquid Network has been paused by the federation while the incident is being resolved, so transfers of AMP assets cannot be settled until block production resumes. Any transfer submitted in the meantime will remain pending; it will not be lost.

What happened

Our preliminary understanding is that a bug in the Elements, an open source software that Liquid runs on, allowed to create 4,000 LBTC that was not backed by real Bitcoin. One party exploited the bug and used a third-party’s (SideSwap) peg-out interface to peg those L-BTC out, which moved approximately 4,000 BTC out of the Liquid federation’s Bitcoin reserve at 14:28 UTC on 6 September 2026. No peg-out authorisation key was compromised. The party responsible has presented itself as acting in a white-hat capacity.

Blockstream disabled the Liquid bridge nodes on 6 September 2026. Nodes then stopped validating blocks, the last block having been validated at 06:49:10 CEST (04:49:10 UTC) on 7 September 2026.

Current status

The withdrawn bitcoin have not been returned as of the time of this note. Blockstream has publicly confirmed that the bug has been remedied and that the funds can safely be returned. A return is expected. The network remains paused.

What is not affected

The bug concerned the creation of L-BTC and its peg-out to bitcoin. Digital securities are not created by that mechanism. The AMP infrastructure through which digital securities are issued and managed is operational and has not been compromised: none were created outside the Issuer's control, and none have been transferred as a result of the incident.

Digital securities are not backed by, and confer no claim on, the federation peg wallet, the bitcoin held in it, or L-BTC. The assets and arrangements backing each instrument sit off the Liquid Network and are unaffected.

The register of holders is held on STOKR infrastructure rather than on the network and is unaffected, and holders can log in and view their holdings as usual.
The terms of each instrument and the rights attaching to it, and the record of each holding, are unaffected.

What is affected

Digital securities cannot be transferred on-chain, deposited, or withdrawn from Biftinex Securities.

Settlement of redemptions that require an on-chain transfer of digital securities is deferred until transfer functionality is restored.

What we are doing

STOKR is monitoring the Liquid Network and the relevant on-chain addresses continuously and is following the public statements of Blockstream and the Liquid Network. Onboarding, whitelisting, registration and reporting operations on the platform are running normally.

A note on fraud

STOKR communicates only through stokr.io and from stokr.io addresses. Issuer notices are made through the communication channels named in the offering documents for the relevant instrument. Neither STOKR nor an Issuer will ever ask you to transfer assets or to disclose a private key, seed phrase or password. Disregard any message that does, and report it to [email protected].