The Liquid Federation said on Nov. 3, 2026, that bitcoin reserves backing all LBTC had returned to a full 1:1 ratio, nearly two months after an exploit allowed approximately 4,000 BTC—valued at about $320 million—to be withdrawn from the network.
The reserve recovery did not establish that all withdrawal restrictions had ended. Users had been able to swap BTC and LBTC through participating providers for several weeks, and some semi-automated peg-outs had resumed. But direct Federation peg-outs had been restricted pending additional security checks, and the Nov. 3 announcement did not clarify whether the remaining limits had been lifted.
Blockstream identified as the source of replacement bitcoin
Liquid Federation board member and former Blockstream executive Samson Mow identified Blockstream as the source of the bitcoin used to close the reserve shortfall.
Mow reported a 50 BTC deposit into the Federation wallet on Oct. 28, leaving 550 BTC outstanding. A further 300 BTC arrived on Monday, Nov. 2, followed by another 250 BTC later that day, restoring full backing.
Reserve balances are published at liquid.network, and Liquid node operators can independently verify the backing. That reserve visibility is distinct from the operational question of which peg-out routes are available to users.
How the reserve gap arose
According to Liquid’s September incident report, the exploit involved a bug in cached range proof verifications in Elements, the software underlying Liquid Network. The attacker created approximately 4,000 unbacked LBTC and used them to withdraw bitcoin through SideSwap, a Liquid wallet and trading platform that is also a Federation member with a peg-out authorization key.
Liquid said its network operators were not hacked and no keys were compromised.
About 4,000 BTC was taken from the Federation wallet on Sept. 6. The attacker returned roughly 3,400 BTC the following day after Blockstream, the developer of Liquid’s underlying technology, patched the affected bridge nodes. About 600 BTC remained withheld.
Blockstream, led by Adam Back, subsequently rejected the attacker’s demand for a 10% bug bounty in exchange for returning the remaining coins. At the time, the company characterized the demand as a ransom and said paying it would set an unacceptable precedent for open-source developers.
Software recovery and pending safeguards
Elements v23.3.4 was released on Sept. 9 to address the vulnerability. Liquid resumed producing blocks later that day, and user transactions returned on Sept. 10, although Federation peg-outs remained disabled at that stage.
In its Nov. 3 update, the Federation said it was preparing governance and oversight changes alongside additional technical and operational safeguards. It expected to provide further details in the coming weeks; those measures were not detailed in the announcement.
Original reporting published Nov. 3, 2026, at 19:48:18 UTC+08:00. Source: The Block.