Following a September exploit that drained about $320 million in BTC and left a gap in its reserve, the Liquid Federation has now announced that it has restored full 1:1 Bitcoin for LBTC.
The missing coins were reportedly supplied by Blockstream. LBTC is the token that represents Bitcoin on Blockstream’s sidechain.
Blockstream filled the reserve gap
Liquid Federation shared the update on X on Tuesday, November 3, writing that it “is pleased to announce that the network’s bitcoin reserves have been fully restored, reestablishing 1:1 BTC backing for all LBTC.”
Blockstream CEO Adam Back shared a screenshot of a dashboard showing Liquid Network’s assets matching liabilities at 100%. The screenshot also showed the reserve deficit is now 0.00 BTC.
Dashboard showing Liquid Network’s assets matching liabilities at 100%.. Source: Adam Back via X/Twitter
When Samson Mow, a Liquid Federation board member and former Blockstream executive, was asked about the source of the funds, he answered, “As stated many times, Blockstream.”
Mow tracked the deposits publicly, showing that 50 BTC landed in the federation wallet on October 28, leaving 550 BTC short. 300 BTC was added to the wallet on Monday, and it was followed by another 250 BTC later the same day, restoring the peg.
Direct swaps between Bitcoin and LBTC had already resumed weeks earlier through participating providers.
However, the Federation has not said whether all remaining peg-out restrictions are now lifted. Also, beyond the Blockstream deposits, the federation has not said anything on how the hole was fully covered.
How attackers printed unbacked LBTC
Self-described white-hat hackers exploited a buy-in in Elements, which is the open-source software that runs Liquid, on September 6.
That flaw was in a cache that stored results of expensive rangeproof checks. Because the cache key left out the asset commitment and the scriptPubKey, a node could reuse a previously verified proof in a context where it was not valid.
This was what enabled the attacker to mint around 4,000 unbacked LBTC and route them through SideSwap’s peg-out service to withdraw real bitcoin.
Private keys were not stolen in the exploit thanks to the federation’s 11-of-15 multisig and SideSwap authorization keys, which worked as designed to prevent such an occurrence.
The following day, the attacker returned 3,400 BTC but held onto about 598 BTC, which was worth around $47 million as of then.
The attacker then demanded a 10% bug bounty in exchange for the remaining BTC. However, Blockstream refused the offer, as it said that it would not “pay a ransom that far exceeds their economic participation.”
A few days later, on September 9, Blockstream shipped a hardened Elements release, v23.3.4.
Can the fixes prevent future attacks?
When asked under his initial post on X what would stop the kind of attack they suffered from from happening again, Back said that three lines of defense have been hardened.
He wrote that peg-out authorization keys (PAK) have been refreshed and moved to cold hardware wallets. The second fix is that proof validation caches have been disabled and the bug has been fixed for nodes.
For the third fix, Back wrote, consensus rules have been hardened, “and fail closed.”
Back added that the systems went through multiple third-party audits.
The warning on AI-suggested fixes
He also said that one of the lessons they learned from the incident is to treat every AI suggestion with suspicion, stating, “don’t trust, verify.”
Back’s warning is not coming from an isolated incident, as independent analysis suggested that the September attacker reverse-engineered the vulnerability from a publicly titled GitHub commit before any production node had been upgraded.
According to Google’s Threat Intelligence Group (GTIG), attackers exploited 141 flaws between January and August 2026; this was 14 incidents more than the 127 that were recorded in the whole of 2025.
It was disclosed that AI tools are shrinking the gap between a bug’s disclosure and a working exploit.
The Liquid Federation has said that it is also preparing changes to governance and oversight, with more detail promised in the coming weeks.
The smartest crypto minds already read our newsletter. Want in? Join them .
