Liquid Network Restores Full Bitcoin (BTC) Reserves After $320M Exploit

Liquid Federation Restores Full Reserves

Two months after an exploit drained most of its reserves, the Liquid Federation confirmed on Monday that the Bitcoin (BTC) backing its Liquid Network sidechain is whole again. The federation said in its announcement that 1:1 backing has been reestablished for all LBTC, the wrapped Bitcoin token issued on Liquid, and that swaps between BTC and LBTC through participating providers had already resumed at parity several weeks earlier. Launched by Blockstream in 2018, Liquid is operated by a federation of exchanges and crypto companies; users lock BTC and receive the same amount of LBTC in return. The milestone matters for the broader Bitcoin ecosystem because LBTC serves as a settlement asset for transfers that need more speed and privacy than the base chain offers. The repair concerns custody rather than Bitcoin (BTC) price action: it restores the promise that every LBTC in circulation sits on a locked Bitcoin under federation control. Blockstream CEO Adam Back, whose company built the technology behind Liquid, posted a dashboard screenshot showing liabilities fully covered, reserves at 100%, and a deficit of 0.00 Bitcoin (BTC). Block explorer data puts circulating supply at 4,270.54 LBTC, roughly $327 million, now matched by an equal amount of Bitcoin. Anyone running a Liquid node can verify the reserves directly. Samson Mow, Blockstream's former chief security officer, wrote on X shortly before the confirmation that 250 BTC had been added to close the remaining shortfall, a gap that had stood near 600 BTC, about $46 million, for nearly two months. The federation did not say where the replacement funds came from, or when a post-mortem on the September incident will be released. It said it is modernizing Liquid's governance structure, introducing clearer responsibilities and oversight plus further technical and operational safeguards, with more details promised in the coming weeks.

The September Exploit and the Missing 598 BTC

The gap dates to September 6, when an attacker exploited a flaw in Elements, the software Blockstream developed and the Liquid federation operates, to mint roughly 4,000 LBTC without any Bitcoin (BTC) behind them. Because the system accepted the counterfeit receipts as genuine, the attacker redeemed them for real coins and withdrew about 4,000 BTC, worth around $320 million at the time, from the federation wallet, using PGP-signed messages embedded in Bitcoin transactions to talk with Blockstream. A day later, after the cross-chain bridge's nodes were patched, 3,400 BTC, about $269 million, came back. The attacker kept roughly 598 BTC, framed as a 10% bounty for discovering the bug, and the coins have not moved since. Blockstream refused to pay a ransom, stating that withholding stolen assets is a crime rather than responsible disclosure. Ledger CTO Charles Guillemet called the arrangement more like extortion than white-hat hacking. The federation behind the network counts 81 members, including Hodl, Specter, CoinShares, Komainu, Xapo and Bull Bitcoin, and any movement of the locked Bitcoin requires 11 of 15 signatures. Users criticized how the crisis was handled: in late September, Canada's Bull Bitcoin said customers could not redeem LBTC through its platform, and founder Francis Pouliot answered the restoration news with a single word, “1:1”. Back, asked on X what would stop a repeat, listed three hardened lines of defense: peg-out authorization keys refreshed and moved into cold hardware wallets, proof validation caches switched off plus a node bug fix, and consensus rules adjusted to fail closed. He added that the network has since completed multiple third-party audits, and warned developers to treat AI-suggested fixes with suspicion rather than trust them blindly.

What the Restore Leaves Unresolved

The restoration clears the main overhang hanging over Liquid users, yet two questions stay open: how the 598 BTC shortfall was financed, and when the promised post-mortem will appear. The exploit also resets the risk model for the network. Its 11-of-15 multisig held; a code flaw in Elements let counterfeit receipts pass as real, a different threat than stolen keys. That distinction matters for the wider Bitcoin DeFi and sidechain ecosystem, where pegged assets inherit the security of the mint-and-redeem code as much as the signatures guarding reserves. Until the federation publishes its governance overhaul, LBTC holders are extending trust to the same 81-member group on the strength of a dashboard reading 100%.