The Liquid Federation said on November 3, 2026, that LBTC is again backed 1:1 by bitcoin, nearly two months after a $320 million exploit. Board member Samson Mow named Blockstream as the source of the replacement coins.
At a Glance
- On-chain reserve figures showed 4,270.54 BTC backing an equal amount of LBTC after the shortfall closed.
- Four deposits totaling roughly 602.5 BTC covered the coins the attacker never sent back to the Federation.
- Blockstream, the developer of Liquid’s underlying technology, had refused the attacker’s demand for a 10% bug bounty.
- Direct Federation peg-outs remain restricted, while BTC and LBTC swaps run through participating providers such as SideSwap.
Blockstream filled the last 600 BTC
The attacker drained about 4,000 BTC from the Federation wallet on September 6. Roughly 3,400 BTC came back the next day, after Blockstream patched the affected bridge nodes. Blockstream’s own assessment put the unrecovered balance at about 602 BTC.
Blockstream, the Adam Back-led company, refused to pay for the rest. It said it would “not be a party to the precedent” of open-source developers paying ransom.
The refill arrived in four transfers. A 2.5 BTC deposit and a 50 BTC deposit landed in late October, and Mow said the second one left 550 BTC outstanding. Transfers of 300 BTC and 250 BTC followed this week, and blockchain records showed about 4,268.95 BTC in reserve once the gap closed. Asked on X who was paying, Mow, a former Blockstream executive, answered: “As stated many times, Blockstream.“
Update from the Liquid Federation: The Liquid Federation is pleased to announce that the network’s bitcoin reserves have been fully restored, reestablishing 1:1 BTC backing for all LBTC. This follows the restoration of BTC<>LBTC swaps several weeks ago, which have since allowed users to move between Bitcoin and Liquid at a 1:1 rate through participating swap providers. Together, these milestones represent significant progress in the Federation’s recovery efforts and reaffirm its commitment to the long-term security, stability and resilience of the Liquid Network. As always, the network’s bitcoin reserves are independently verifiable. Users operating their own Liquid nodes can directly verify the Federation’s Proof of Reserves, while reserve balances and network activity can be monitored through the public dashboard at https://t.co/M46Zhn8nlY. We extend our sincere appreciation to the Bitcoin community, Liquid users, and ecosystem partners for their patience, understanding, and continued engagement throughout the recovery process. Your support and involvement has been instrumental as we worked to restore the network’s reserves and strengthen its underlying infrastructure. Strengthening the Liquid Network for the Future Looking ahead, the Federation is advancing several important initiatives designed to strengthen the network’s long-term security, governance, and operational resilience. These efforts include modernizing the governance structure, introducing clearer responsibilities and oversight, and implementing additional technical and operational safeguards to further protect the network and its participants. More details on these initiatives and the Federation’s next steps will be shared in the coming weeks. Restoring full bitcoin backing marks an important milestone, but our work continues. The Federation remains committed to building on the progress of recent years, advancing Liquid’s development, and strengthening the network’s resilience and accessibility for all participants.
— Liquid Network 🌊 (@Liquid_BTC) November 3, 2026
A caching bug minted 4,000 unbacked LBTC
Liquid’s incident report traced the exploit to cached range proof verifications in Elements, the open-source software that runs the sidechain. The flaw let the attacker create roughly 4,000 LBTC with no bitcoin behind them. The attacker then redeemed those tokens through SideSwap, a Federation member holding a peg-out authorization key. Reserves fell from about 4,205 BTC to 197 BTC after the exploit and other withdrawals.
Liquid said its network operators were not hacked and no keys were compromised. That distinction matters for a federated design: the keys held, yet the software accepted coins that never existed. Blockstream shipped Elements v23.3.4 to fix the bug, and Liquid resumed block production the same day. User transactions returned a day later, and the network has since begun an independent security review of that release.
Swaps reopened before the Federation’s own exit
BTC and LBTC swaps restarted through participating providers under the Federation’s October 20 recovery plan. SideSwap reopened its conversion service under that plan. It swaps LBTC for BTC at 1:1, minus a 0.1% fee, but pays from its own bitcoin wallet. That wallet needs manual top-ups, so SideSwap has warned that withdrawals can queue when its balance runs low.
Direct Federation peg-outs still face added security and operational checks, with no confirmed reopening date. Some semi-automated peg-outs have resumed, though the Federation’s statement didn’t say whether the remaining limits were lifted. LBTC holders can check reserve balances on liquid.network or verify the backing with their own Liquid node, an on-chain form of proof of reserves.
The Federation hasn’t published a breakdown of who supplied the replacement bitcoin. On-chain records prove the coins arrived; they don’t prove who owned the sending wallets. SideSwap thanked Blockstream and Federation members but didn’t name a funder itself.
The Bottom Line
That leaves open questions. Did any Federation members contribute alongside Blockstream? Who are the people behind the exploit, who called themselves white-hat researchers without independent confirmation? When will direct peg-outs reopen?
Blockstream, if Mow’s account holds, kept its no-ransom line and absorbed the shortfall itself. The Federation said it is preparing governance and oversight changes plus new technical and operational safeguards. It expects to share details “in the coming weeks.“
