The Liquid Federation said on Nov. 3, 2026, that it had restored full 1:1 bitcoin backing for all LBTC, nearly two months after an exploit allowed approximately 4,000 BTC—valued at about $320 million—to be withdrawn from the network.
Federation board member and former Blockstream executive Samson Mow identified Blockstream as the source of the bitcoin used to close the reserve shortfall. The reserve announcement did not establish that all remaining restrictions on direct Federation withdrawals had been lifted.
How the reserve gap was closed
The attacker took about 4,000 BTC from Liquid’s Federation wallet on Sept. 6. Roughly 3,400 BTC was returned the following day after Blockstream, the developer of Liquid’s underlying technology, patched the affected bridge nodes. The attacker withheld approximately 600 BTC.
Blockstream, led by Adam Back, subsequently rejected the attacker’s demand for a 10% bug bounty in exchange for returning the remaining coins. At the time, the company said it would not establish a precedent of open-source developers paying a ransom that far exceeded their economic participation.
Mow reported a 50 BTC deposit into the Federation wallet on Oct. 28, leaving 550 BTC outstanding. Another 300 BTC arrived on Monday, Nov. 2, followed by a further 250 BTC later that day, restoring full backing. Asked on X where the bitcoin came from, Mow replied: “As stated many times, Blockstream.”
The Federation said reserve balances are published on Liquid’s website and can also be verified independently by Liquid node operators.
Full backing did not confirm unrestricted peg-outs
By the Nov. 3 report, users had been able to swap BTC and LBTC through participating providers for several weeks. Direct Federation peg-outs had previously been restricted pending additional security checks, though some semi-automated peg-outs had resumed.
The Federation’s announcement did not say whether the remaining restrictions had been removed. Restored reserve backing and the availability of direct Federation peg-outs therefore remained distinct issues in the reported recovery.
Software flaw and planned safeguards
Liquid’s September incident report traced the exploit to a bug involving cached range proof verifications in Elements, the software underlying the network. The flaw allowed the attacker to create approximately 4,000 unbacked LBTC and use them to withdraw bitcoin through SideSwap, a Liquid wallet and trading platform that is also a Federation member with a peg-out authorization key.
Liquid said its network operators were not hacked and no keys were compromised.
Elements v23.3.4 was released on Sept. 9 to address the vulnerability. Liquid resumed block production later that day, and user transactions returned on Sept. 10. Federation peg-outs remained disabled at that stage.
In its Nov. 3 update, the Federation said it was preparing governance and oversight changes, alongside additional technical and operational safeguards. It expected to provide further details in the coming weeks; those measures were not detailed in the report.
Original source: The Block, published Nov. 3, 2026, at 19:48:18 UTC+08:00. This article preserves the historical reporting context.
