The attacker exploited a vulnerability in Liquid Network's Elements to mint unbacked L-BTC and stole approximately 4,000 BTC (around $320 million). On September 7, about 3,400 BTC were returned, with roughly 600 BTC still under negotiation. The vulnerability was located in the transaction verification layer before withdrawals. Both SideSwap and functionary nodes accepted these assets, which were then swapped for real BTC. Liquid's reserves temporarily dropped from around 4,205 BTC to 197 BTC. A patch for the bridge node has been deployed, but the withdrawal channel remains unrecovered.