Crypto
Liquid Network Says Bitcoin Backing Is Fully Restored Two Months After $320 Million Exploit
Image: EivindPedersen via Pixabay
The federation says every LBTC is again backed one-to-one, but it has not said where the last roughly 600 bitcoin came from.
By Noris Ortiz ·
The Liquid Federation, which runs the bitcoin sidechain Liquid Network, said its reserves have been fully restored after an exploit in September that drained roughly 95% of the bitcoin backing its LBTC token, according to CoinDesk [1]. The federation said on X that reserves were "fully restored, reestablishing 1:1 BTC backing for all LBTC" after a final transfer of 250 bitcoin [1].
Liquid is a sidechain run by a federation of firms led by Blockstream. Users lock bitcoin with the federation and receive LBTC, a token meant to be redeemable for one bitcoin, and exchanges and traders use it to move value faster than on the main bitcoin network [1]. That one-to-one promise is what was broken on September 6, when someone withdrew about 4,000 bitcoin, worth roughly $320 million at the time, from the federation wallet [2]. The amount equaled about 95% of Liquid's reported reserves of roughly 4,200 bitcoin [2]. An on-chain message attached to the transaction read "we are whitehats. contact us on chain," The Block reported [2].
A later account from The Block described the technical cause. The flaw was in how Elements, the software underlying Liquid, cached range-proof verifications, which allowed about 4,000 LBTC to be created without bitcoin behind them [3]. The attacker used SideSwap, a federation member holding a peg-out authorization key, to convert the unbacked tokens into bitcoin through a standard peg-out. Liquid has said its network operators were not hacked and no keys were compromised [3]. Blockstream's incident report put the reserve drop from about 4,205 bitcoin to 197 bitcoin, CoinDesk said [1].
The attacker returned about 3,400 bitcoin on September 7, leaving roughly 598.5 bitcoin unreturned [3]. On September 9 Blockstream deployed a patched version of Elements, and block production and transactions resumed on September 10, though peg-outs stayed disabled as a precaution [3]. By September 11 the exploiter had demanded a 10% bug bounty on the remaining coins, and Blockstream refused, calling the episode theft rather than responsible disclosure and saying it would work with law enforcement, exchanges and forensic specialists [3].
CoinDesk's latest report says the missing gap has now been closed, but the federation did not say where the remaining roughly 600 bitcoin, worth more than $40 million, came from [1]. Anyone can check the balance on the network's public dashboard, the report added [1]. That leaves an open question for users: whether the shortfall was covered from recovered funds, from federation resources or from another source. Without that disclosure, the restored reserves can be verified on-chain but the funding decision cannot.
Operations are still not back to normal. Users have been able to swap bitcoin and LBTC at one-to-one through providers such as SideSwap since late October, but direct withdrawals through the federation remain under what it calls enhanced operational controls [1]. The federation said it would share more about governance changes in the coming weeks [1].
The episode illustrates a risk that is separate from price: tokens that represent bitcoin on another network depend on the integrity of the bridge, the software and the parties that hold the keys. For traders, the practical signals to watch are whether exchanges that paused LBTC deposits and withdrawals in September fully reopen them, whether peg-outs return, and what governance changes the federation proposes [1][2].
Sources:
[1] CoinDesk, "Liquid's bitcoin (BTC) IOUs are fully backed again after a $320 million exploit", November 3, 2026. https://www.coindesk.com/markets/2026/11/03/liquid-s-bitcoin-ious-are-fully-backed-again-after-a-usd320-million-exploit
[2] The Block, "Liquid Network pauses after purported 'white-hat' hackers withdraw $320 million in bitcoin", September 6, 2026. https://theblock.co/news/defi/2026-09-06-liquid-network-pauses-after-purported-white-hat-hackers-withdraw-320-million-in-bitcoin-413626
[3] The Block, "'Return the bitcoin': Blockstream refuses ransom demand for remaining 600 BTC from Liquid exploit", September 11, 2026. https://www.theblock.co/news/ecosystems/2026-09-11-blockstream-refuses-ransom-demand-for-remaining-600-btc-from-liquid-exploit-414247
This article was produced with AI assistance. It is for informational purposes only and is not financial advice. StockVolt and its authors may hold positions in securities mentioned.