Source published: November 3, 2026, at 19:48:18 UTC+8. This article reflects the reporting available at that time.
Liquid’s bitcoin reserves have returned to full 1:1 backing for all LBTC, according to a November 3 announcement from the Liquid Federation reported by The Block. The restoration came nearly two months after an exploit involving approximately 4,000 BTC, valued in the report at about $320 million.
The reserve recovery does not, by itself, establish that all withdrawal restrictions have ended. Users had been able to swap BTC and LBTC through participating providers for several weeks, and some semi-automated peg-outs had resumed. But the Federation’s announcement did not clarify whether the remaining restrictions on direct Federation peg-outs had been lifted.
How the reserve gap was closed
The September 6 exploit removed about 4,000 BTC from the Federation wallet. The attacker returned roughly 3,400 BTC the next day after Blockstream, the developer of Liquid’s underlying technology, patched the affected bridge nodes. About 600 BTC remained withheld.
Blockstream, led by Adam Back, subsequently rejected the attacker’s demand for a 10% bug bounty in exchange for returning the remaining coins. At the time, the company characterized the demand as a ransom and rejected the precedent of requiring open-source developers to make such payments.
Liquid Federation board member and former Blockstream executive Samson Mow reported the deposits that closed the remaining shortfall:
- October 28: 50 BTC deposited, leaving 550 BTC outstanding.
- Monday, November 2: 300 BTC deposited, followed by another 250 BTC later that day.
Mow identified Blockstream as the source of the replenishment funds. That attribution is distinct from the attacker’s earlier partial return: the final reserve gap was closed through deposits Mow attributed to Blockstream, not through a reported recovery of the withheld coins.
The exploit targeted verification logic, not stolen keys
Liquid’s September incident report traced the vulnerability to cached range-proof verifications in Elements, the software underlying the network. According to that account, the attacker created approximately 4,000 unbacked LBTC and used them to withdraw bitcoin through SideSwap, a Liquid wallet and trading platform that is also a Federation member with a peg-out authorization key.
Liquid said network operators were not hacked and no keys were compromised. The reported failure therefore concerned the software’s verification logic rather than a compromise of signing keys.
Elements v23.3.4 was released on September 9 to address the vulnerability. Liquid resumed block production later that day, and user transactions returned on September 10. Federation peg-outs remained disabled at that stage.
Reserve restoration and operational recovery are separate questions
The Federation said reserve balances are published at liquid.network and that Liquid node operators can independently verify the backing. Those disclosures address the reserve position; they do not resolve the separate question of which withdrawal pathways were fully available at the reporting date.
The latest update also said the Federation was preparing governance and oversight changes alongside additional technical and operational safeguards, with further details expected in the following weeks. These were planned measures, not documented completed changes in the supplied report.
The supported conclusion is narrow: the Federation reported restored 1:1 backing, and Mow attributed the final replenishment to Blockstream. Full removal of peg-out restrictions and the substance of the proposed safeguards remained unresolved in the November 3 account.