The Liquid Federation said on Nov. 3, 2026, that its bitcoin reserves again fully backed all LBTC at a 1:1 ratio, nearly two months after an exploit drained approximately 4,000 BTC—about $320 million—from its Federation wallet.
Liquid Federation board member and former Blockstream executive Samson Mow identified Blockstream as the source of the bitcoin used to close the reserve shortfall. The restoration addresses the backing gap; the announcement did not establish that all withdrawal restrictions had ended.
How the reserve gap was closed
Following the Sept. 6 exploit, the attacker returned roughly 3,400 BTC the next day after Blockstream patched the affected bridge nodes, but retained about 600 BTC. Blockstream, the developer of Liquid’s underlying technology, subsequently rejected the attacker’s demand for a 10% bug bounty in exchange for returning the remaining coins.
Mow reported the following deposits into the Federation wallet:
- Oct. 28: 50 BTC, leaving 550 BTC outstanding.
- Monday, Nov. 2: 300 BTC, followed by another 250 BTC later that day, restoring full backing.
Asked on X where the bitcoin was coming from, Mow replied: “As stated many times, Blockstream.”
Reserve balances are published at liquid.network, and Liquid node operators can independently verify the backing.
Full backing does not settle the peg-out question
At the time of the report, users had been able to swap BTC and LBTC through participating providers for several weeks. Direct Federation peg-outs had previously been restricted pending additional security checks, although some semi-automated peg-outs had resumed.
The Nov. 3 announcement did not say whether the remaining restrictions had been lifted. Restored reserves and unrestricted redemption are distinct questions; the update addressed the former without fully resolving the latter.
What Liquid said caused the exploit
Liquid’s September incident report attributed the exploit to a bug involving cached range proof verifications in Elements, the software underlying the network. According to that account, the attacker created approximately 4,000 unbacked LBTC and used them to withdraw bitcoin through SideSwap, a Liquid wallet and trading platform that is also a Federation member with a peg-out authorization key.
Liquid said its network operators were not hacked and no keys were compromised.
Elements v23.3.4 was released on Sept. 9 to address the vulnerability. Liquid resumed block production later that day, and user transactions returned on Sept. 10. Federation peg-outs remained disabled at that stage.
The Federation’s Nov. 3 update said it was preparing governance and oversight changes alongside additional technical and operational safeguards. It expected to provide details in the following weeks; those measures were not yet detailed in the supplied report.
Original report: The Block, published Nov. 3, 2026, at 19:48:18 UTC+08:00.