The Liquid Federation said on Nov. 3, 2026, that it had restored full 1:1 bitcoin backing for all LBTC, nearly two months after an exploit allowed approximately 4,000 BTC—worth about $320 million—to be withdrawn from the network.
According to The Block’s report, Liquid Federation board member and former Blockstream executive Samson Mow identified Blockstream as the source of the bitcoin used to close the reserve gap.
What full backing means for LBTC
LBTC is the bitcoin-backed token used on the Liquid sidechain. The Federation’s announcement means its reserves once again held one BTC for every LBTC. Reserve balances are published at liquid.network, and Liquid node operators can independently verify the backing.
Reserve backing and access to withdrawals are separate questions. Users had been able to swap BTC and LBTC through participating providers for several weeks before the announcement. However, direct Federation peg-outs—withdrawals from Liquid back to Bitcoin—had previously been restricted pending additional security checks.
Some semi-automated peg-outs had resumed, but the Nov. 3 announcement did not clarify whether the remaining restrictions had been lifted.
How the reserve gap was closed
The Sept. 6 exploit took about 4,000 BTC from the Federation wallet. After Blockstream, the developer of Liquid’s underlying technology, patched the affected bridge nodes, the attacker returned roughly 3,400 BTC the following day but withheld about 600 BTC.
Blockstream, led by Adam Back, subsequently rejected the attacker’s demand for a 10% bug bounty in exchange for returning the remaining coins. At the time, the company said it would not establish a precedent of open-source developers paying a ransom that far exceeded their economic participation.
Mow later reported the deposits that filled the shortfall:
- Oct. 28: 50 BTC was deposited, leaving 550 BTC outstanding.
- Monday, Nov. 2: Another 300 BTC arrived, followed by 250 BTC later that day, restoring full backing.
When asked on X where the bitcoin was coming from, Mow replied: “As stated many times, Blockstream.”
The flaw allowed unbacked LBTC to be created
Liquid’s September incident report traced the exploit to a bug involving cached range proof verifications in Elements, the software underlying the network.
The attacker created approximately 4,000 unbacked LBTC and used them to withdraw bitcoin through SideSwap, a Liquid wallet and trading platform. SideSwap is a Federation member with a peg-out authorization key.
Liquid said its network operators were not hacked and no keys were compromised.
Elements v23.3.4 was released on Sept. 9 to address the vulnerability. Liquid resumed producing blocks later that day, and user transactions returned on Sept. 10. Federation peg-outs remained disabled at that stage.
Further safeguards were still being prepared
In its Nov. 3 update, the Federation said it was preparing governance and oversight changes alongside additional technical and operational safeguards. It expected to share details in the following weeks.
For LBTC users, the reported restoration addressed the reserve shortfall. It did not, by itself, establish that every withdrawal route had returned to unrestricted operation.
Original report published Nov. 3, 2026, at 19:48:18 UTC+08:00. Source: The Block.