The Liquid Federation said on Nov. 3, 2026, that its bitcoin reserves again provided full 1:1 backing for all LBTC, nearly two months after an exploit allowed approximately 4,000 BTC—valued at about $320 million—to be withdrawn from the network.
Liquid Federation board member and former Blockstream executive Samson Mow identified Blockstream as the source of the bitcoin used to close the reserve gap. Restored backing did not, however, establish that all withdrawal restrictions had ended: the announcement did not clarify whether the remaining limits on direct Federation peg-outs had been lifted.
How the exploit crossed the bitcoin–Liquid boundary
According to Liquid’s September incident report, the exploit stemmed from a bug involving cached range proof verifications in Elements, the software underlying Liquid Network. The attacker created approximately 4,000 unbacked LBTC and used them to withdraw bitcoin through SideSwap, a Liquid wallet and trading platform that is also a Federation member with a peg-out authorization key.
The failure therefore involved unbacked assets on Liquid being used to obtain bitcoin from the Federation’s reserves. Liquid said its network operators were not hacked and no keys were compromised.
About 4,000 BTC was taken from the Federation wallet on Sept. 6. The attacker returned roughly 3,400 BTC the next day after Blockstream, which develops Liquid’s underlying technology, patched the affected bridge nodes. About 600 BTC remained withheld.
Blockstream, led by Adam Back, subsequently rejected the attacker’s demand for a 10% bug bounty in exchange for returning the remaining coins, saying it would not set a precedent of paying a ransom far beyond its economic participation.
Elements v23.3.4 was released on Sept. 9 to address the vulnerability. Liquid resumed block production later that day, and user transactions returned on Sept. 10. Federation peg-outs remained disabled at that stage.
Deposits closed the reserve shortfall
Mow reported a 50 BTC deposit into the Federation wallet on Oct. 28, leaving 550 BTC outstanding. Another 300 BTC arrived on Monday, Nov. 2, followed by a further 250 BTC later that day, restoring full backing. Asked on X where the bitcoin came from, Mow answered: “As stated many times, Blockstream.”
The Federation said reserve balances are published at liquid.network and that Liquid node operators can independently verify the backing.
Reserve backing and withdrawal access are separate
By the Nov. 3 report, users had been able to swap BTC and LBTC through participating providers for several weeks. Direct Federation peg-outs had previously been restricted pending additional security checks, though some semi-automated peg-outs had since resumed.
The Federation’s announcement left the status of the remaining restrictions unresolved. Full reserve backing and unrestricted access to direct peg-outs were therefore distinct questions in the update.
The Federation also said it was preparing governance and oversight changes, along with additional technical and operational safeguards. It expected to provide further details in the coming weeks.
Original publication: Nov. 3, 2026, at 19:48:18 UTC+08:00.
Source: The Block — Liquid Network restores full bitcoin backing following $320 million exploit
