TL;DR
- Liquid Network restored 1:1 Bitcoin backing for all LBTC two months after an exploit drained about 4,000 BTC, worth roughly $320 million, from the Federation wallet.
- Around 3,400 BTC were returned, while Blockstream supplied Bitcoin that closed the reserve gap after rejecting a demand tied to the unrecovered coins.
- Liquid hardened peg-out keys, disabled vulnerable verification caches and strengthened consensus rules, while some peg-out restrictions may remain.
Liquid Network has restored full Bitcoin backing for all LBTC, nearly two months after a security exploit drained 4,000 BTC, worth roughly $320 million, from the Federation wallet. In an official update, the Liquid Federation said reserves had returned to 1:1 parity. The milestone closes the reserve deficit that threatened LBTC’s backing to Bitcoin after the September incident, although operational restrictions may remain.
Update from the Liquid Federation:
The Liquid Federation is pleased to announce that the network’s bitcoin reserves have been fully restored, reestablishing 1:1 BTC backing for all LBTC.
This follows the restoration of BTC<>LBTC swaps several weeks ago, which have since allowed…
— Liquid Network 🌊 (@Liquid_BTC) November 3, 2026
Liquid Restores Reserves and Hardens Network Security
The September 6 exploit allowed an attacker to create roughly 4,000 unbacked LBTC and use them to withdraw Bitcoin. Liquid later traced the vulnerability to cached range-proof verification in Elements, the software underlying the network. Operators were not hacked and federation keys were not compromised. The incident created counterfeit LBTC at the protocol level before converting that value into real BTC, explaining why the network’s controlled recovery required both software fixes and reserve restoration.
About 3,400 BTC were returned the following day, leaving roughly 600 BTC unrecovered. Blockstream subsequently rejected a demand for a 10% bounty tied to returning the remaining coins. Federation board member Samson Mow later identified Blockstream as the source of Bitcoin used to close the reserve gap, including deposits made in late October and early November. Those deposits restored the missing collateral rather than recovering the outstanding Bitcoin from the attacker, following the earlier partial return of 3,400 BTC.
The technical response has also focused on preventing a repeat. Adam Back said peg-out authorization keys were refreshed and moved into cold hardware wallets, proof-validation caches were disabled alongside a node bug fix, and consensus rules were hardened to fail closed. The network also underwent multiple third-party audits. Liquid’s recovery therefore extends beyond replenishing reserves to hardening the infrastructure that protects the BTC-LBTC peg, after investigators detailed the range-proof cache vulnerability.
BTC-LBTC swaps through participating providers had already returned at a 1:1 rate several weeks before the latest reserve announcement. Direct Federation peg-outs had remained restricted pending additional security checks, while some semi-automated peg-outs resumed; the announcement did not confirm whether every remaining restriction was lifted. Full reserve backing marks a financial recovery milestone, but it does not automatically mean every network safeguard has returned to its pre-exploit state. The Federation also said it is modernizing governance, clarifying responsibilities and adding technical and operational protections after Blockstream’s refusal to pay for the remaining Bitcoin.
