Liquid Network restores full bitcoin backing two months after exploit

The Liquid Federation said on Nov. 3 that the network's bitcoin reserves have been fully restored, "reestablishing 1:1 BTC backing for all LBTC," two months after an exploit drained most of the reserve. In its announcement, posted at 12:03 AM UTC, the federation said the milestone follows the restoration of BTC-to-LBTC swaps several weeks earlier through participating swap providers, and that node operators can verify its proof of reserves directly while balances appear on the public dashboard at liquid.network.

Liquid is a production Bitcoin sidechain built on Elements, the open-source platform Blockstream develops. BTC locked through a peg-in is matched one for one by LBTC issued on Liquid, so the reserve has to track circulating LBTC for the token to stay redeemable.

The dashboard backed the claim. SideSwap, a federation member that runs a peg-out service, said liquid.network showed 4,270.54 L-BTC in circulation against 4,270.54 BTC in the federation reserve on the morning of Nov. 3, matching the position that existed before Sept. 6. crypto.news reported roughly 4,268.95 BTC against an equal amount of LBTC at the moment the shortfall closed, with the figure rising to 4,270.54 by the following day.

The last gap closed in steps visible on the Bitcoin chain. According to SideSwap, deposits of 2.5 BTC on Oct. 27 and 50 BTC on Oct. 28 were followed on Nov. 2 by transfers of 300 BTC and then 250 BTC into the federation's peg wallet. crypto.news described the same sequence of four deposits totaling roughly 602.5 BTC.

Neither the announcement nor the federation identified who supplied the replacement bitcoin. Decrypt noted that the statement did not say how the shortfall was covered. Asked on X where the coins were coming from, Liquid Federation board member Samson Mow wrote, "As stated many times, Blockstream." SideSwap thanked Blockstream and the federation's members for completing the recovery but declined to name the funding source itself, and the federation has published no allocation of the replacement funds.

The hole dates to Sept. 6, when a flaw in Elements, the software Liquid runs on, let an attacker create about 4,000 LBTC with nothing behind them and redeem them for bitcoin. Blockstream's incident assessment attributed the exploit to a defect in the rangeproof verification cache introduced in 2018, and said smaller peg-outs before the halt cut the reserve from about 4,205 BTC to 197 BTC. The attacker posted on-chain hours later that "we are whitehats. contact us on chain," then returned 3,400 BTC on Sept. 7 after negotiations, leaving roughly 602 BTC outstanding at the time of the report. Blockstream shipped the fixed release, Elements v23.3.4, on Sept. 9.

Decrypt reported that the group kept around 598 BTC of the roughly 4,000 BTC withdrawn, and that Blockstream refused to pay a ransom for the remainder, saying in September that "taking assets without authorization and withholding their return is a crime, not responsible disclosure" and "it is theft."

Blockstream CEO Adam Back, whose company develops the technology behind Liquid, posted a screenshot of the reserve dashboard showing assets matching liabilities at 100% with a deficit of 0.00 BTC. Asked what would prevent a repeat, he listed three hardened lines of defense: peg-out authorization keys refreshed into cold hardware wallets, proof validation caches disabled alongside a node bug fix, and consensus rules hardened to "fail closed," plus multiple third-party audits. He also urged developers to "treat with suspicion (don't trust, verify) AI suggested fixes."

Backed reserves are not the same as a fully open bridge. Direct peg-outs through the federation remain restricted with no confirmed reopening date, according to crypto.news. The SideSwap service has offered peg-outs since Oct. 20 at a one-to-one rate less a 0.1% fee, but those payouts come from its own bitcoin wallet, which it refills by hand, so queued orders can wait for the next refill. The federation's own staged recovery update of Oct. 20 placed the controlled reactivation of peg-outs for authorized key holders after full 1:1 backing, subject to completion of the remaining security and operational requirements.

The federation said it is modernizing its governance structure, introducing clearer responsibilities and oversight, and adding further technical and operational safeguards, with more details to come in the coming weeks.