USD
Liquid Network Restores Bitcoin Backing After $320 Million Exploit
Blockstream replenished missing reserves as the federation outlined additional security measures and governance changes
TL;DR
- The Liquid Federation confirmed that Bitcoin reserves are fully restored, reestablishing 1:1 backing for LBTC nearly two months after a major exploit.
- Blockstream supplied the missing bitcoin after attackers returned most of the stolen funds but withheld nearly 600 BTC, according to Liquid Federation board member Samson Mow.
- Blockstream CEO Adam Back detailed strengthened security measures, while the federation announced plans to improve governance and oversight.
Trade smarter on Jupiter, Solana’s leading DEX built for fast execution and deep liquidity.
Swap tokens at competitive rates, route across multiple liquidity sources automatically, and access perpetuals, DCA, and advanced trading tools — all in one place!
The Liquid Federation announced on November 3, 2026, that the Liquid Network had restored full 1:1 Bitcoin backing for all LBTC, nearly two months after a September exploit allowed attackers to withdraw approximately 4,000 BTC worth $320 million. Liquid Federation board member Samson Mow identified Blockstream, the company developing Liquid's underlying technology, as the source of the replacement bitcoin used to close the remaining reserve shortfall.
Blockstream CEO Adam Back shared a screenshot of Liquid's reserve dashboard showing assets matching liabilities at 100%, with a remaining deficit of 0.00 BTC. The federation said Liquid node operators could independently verify the reserves, with balances also publicly available through liquid.network.
The announcement followed the restoration of BTC-to-LBTC swaps through participating providers several weeks earlier. Direct Federation peg-outs, which allow users to withdraw bitcoin from the sidechain, had previously been restricted pending additional security checks. Some semi-automated peg-outs have since resumed, although the federation's latest announcement did not establish whether all remaining restrictions had been lifted.
How the September Exploit Drained Liquid's Bitcoin Reserves
Launched by Blockstream in 2018, Liquid is a Bitcoin sidechain designed to support faster and more private transfers. Users deposit bitcoin into a wallet controlled by the Liquid Federation, a group of exchanges and other cryptocurrency companies that operate the network, and receive an equivalent amount of LBTC.
The September 6 exploit stemmed from a vulnerability involving cached range proof verifications in Elements, the software underlying Liquid Network. According to Liquid's incident report, the flaw allowed attackers to create approximately 4,000 unbacked LBTC and use them to withdraw bitcoin through SideSwap, a Liquid wallet and trading platform that holds a Federation peg-out authorization key.
The attackers, who described themselves as white-hat hackers, communicated with Blockstream through PGP-signed messages embedded in Bitcoin transactions. Liquid maintained that its network operators had not been hacked and that no cryptographic keys were compromised.
On September 7, the attackers returned approximately 3,400 BTC, valued at about $269 million, after Blockstream patched the affected bridge nodes.
Blockstream subsequently rejected the attackers' demand for a 10% bug bounty in exchange for returning the remaining funds. The company said it would not establish a precedent in which developers of open-source Bitcoin software could be pressured into paying large ransoms.
"We will not be a party to the precedent that open-source software developed for the good of the Bitcoin community should subject its developers to paying a ransom that far exceeds their economic participation," Blockstream said.
The company also rejected the attackers' characterization of the incident as responsible security research.
"Taking assets without authorization and withholding their return is a crime, not responsible disclosure," Blockstream said. "It is not white-hat activity. It is theft."
Ledger Chief Technology Officer Charles Guillemet similarly questioned the claimed white-hat justification, saying that if the retained funds were intended as a negotiated reward, the arrangement looked "more like extortion than white-hat hacking."
The recovery process continued with the release of Elements v23.3.4 on September 9 to address the underlying vulnerability. Liquid resumed producing blocks later that day, followed by the restoration of user transactions on September 10. Federation peg-outs remained disabled at that stage while additional security measures were implemented.
Blockstream Deposits Close Liquid's Remaining Reserve Gap
Blockstream supplied the bitcoin needed to restore Liquid's reserves, according to Samson Mow, a Liquid Federation board member and former Blockstream executive.
Mow documented a series of deposits to the Federation wallet during the final stage of the recovery.
When asked on X where the replacement bitcoin was coming from, Mow replied, "As stated many times, Blockstream."
The Liquid Federation's announcement confirmed that the network had regained full backing for its issued LBTC, resolving the reserve deficit that persisted after the attackers' partial repayment.
Adam Back Details Security Changes and AI-Related Risks
Back said Liquid had strengthened its defenses following the exploit, describing three layers of protection designed to prevent a similar incident.
The measures include refreshed peg-out authorization keys stored in cold hardware wallets, disabled proof-validation caches alongside a node software fix, and consensus rules strengthened to "fail closed" when required security conditions are not satisfied. Back also said the network had undergone multiple third-party security audits.
Alongside those changes, the Blockstream CEO warned developers against relying on unverified AI-generated security recommendations.
"And lesson: treat with suspicion (don't trust, verify) AI suggested fixes," Back wrote on X.
Back had previously discussed the growing role of artificial intelligence in cybersecurity during an October 20 interview with Bloomberg Television, describing "a wave of AI-assisted security analysis" over the preceding months.
"AI, of course, is a tool to help develop code and to secure the code, but also it can be used to find defects," he said, adding that the trend had been "affecting many companies in the sector."
At the time of that interview, Back said the funds involved in the exploit remained "under investigation."
Beyond the technical changes, the Liquid Federation said it was modernizing its governance structure to establish clearer responsibilities and strengthen oversight. Additional technical and operational safeguards are also being prepared, with further information expected in the coming weeks.
"We extend our sincere appreciation to the Bitcoin community, Liquid users, and ecosystem partners for their patience, understanding, and continued engagement throughout the recovery process," the Liquid Federation said.
"Your support and involvement has been instrumental as we worked to restore the network's reserves and strengthen its underlying infrastructure."
This article has been refined and enhanced by ChatGPT.
