Liquid: exploit fix released in Elements v23.3.4, peg-outs still halted, about 600 BTC not returned
The Liquid Federation and Blockstream report that the root cause and exploitation path of the September 6 incident have been identified, and an immediate fix has been released in Elements v23.3.4. Of the approximately 4,000 BTC withdrawn in the attack, 3,400 BTC has been returned to the federation's reserve; around 600 BTC remains unreturned, and efforts to recover it are ongoing. Block production and transfers of Liquid assets, including LBTC, have been operational since September 10, but peg-out operations remain suspended pending confirmation of full 1:1 LBTC backing and completion of updates, testing and independent audits. There is no date for resuming peg-outs; a detailed technical report is promised later.
Operators of Elements nodes and Liquid infrastructure should update to v23.3.4 now, without waiting for the technical report. LBTC holders should not count on withdrawing to BTC through peg-out or make urgent plans around it: there is no timeline for resumption. Before any deposit, withdrawal or swap, check the actual availability of the operation through the particular service's official channels: some wallets still have LBTC-to-BTC and LBTC-to-Lightning routes disabled.
Source: x.com - AquaBitcoin