Liquid Network says LBTC is fully backed again after September hack

Liquid Network has restored full Bitcoin backing for its LBTC tokens nearly two months after a software exploit drained most of the sidechain’s reserves, although direct withdrawals remain restricted.

In a Tuesday statement, the Liquid Federation confirmed that reserves were “fully restored, reestablishing 1:1 BTC backing for all LBTC.”

The announcement followed several Bitcoin transfers into the federation’s reserve wallet, including a final 250 BTC deposit on November 2. Blockchain records showed approximately 4,268.95 BTC backing an equivalent amount of LBTC when the shortfall was closed.

Update from the Liquid Federation:

The Liquid Federation is pleased to announce that the network’s bitcoin reserves have been fully restored, reestablishing 1:1 BTC backing for all LBTC.

This follows the restoration of BTC<>LBTC swaps several weeks ago, which have since allowed…

— Liquid Network 🌊 (@Liquid_BTC) November 3, 2026

Liquid Network closes 600 BTC shortfall after exploit

The recovery followed a September 6 attack involving Elements, the open-source software used by Liquid Network.

In its security incident assessment, Blockstream explained that a flaw in transaction verification allowed an attacker to create roughly 4,000 LBTC without depositing the corresponding Bitcoin.

The attacker then converted those tokens into actual BTC through SideSwap, a federation member authorized to process withdrawals.

Liquid’s reserves fell from approximately 4,205 BTC to 197 BTC as a result of the unauthorized transactions and other withdrawals completed before operations stopped.

On September 7, the attacker returned 3,400 BTC after communicating with Blockstream through messages recorded on Bitcoin’s blockchain.

The individuals involved claimed to be white-hat security researchers, although their identities and motives were not independently established.

Blockstream’s September assessment placed the remaining unrecovered amount at roughly 602 BTC.

Reserve restoration accelerated in late October, beginning with a 2.5 BTC deposit on October 27 and another 50 BTC the following day.

Two larger transfers completed the process on November 2, adding 300 BTC and 250 BTC to the federation wallet.

Subsequently, SideSwap confirmed the deposit sequence and reported that reserves matched the circulating LBTC supply.

By November 3, updated figures showed 4,270.54 BTC backing the same amount of LBTC, reflecting additional activity after the initial restoration.

Who paid to restore Liquid Network’s Bitcoin reserves?

Although the blockchain records show the deposits, the federation’s latest statement does not identify every party responsible for providing the replacement Bitcoin.

The distinction matters because returning the stolen funds and supplying fresh Bitcoin are different recovery methods.

Of the original amount withdrawn, the attacker returned 3,400 BTC in September. The remaining shortfall was covered through later deposits.

Samson Mow, who sits on the Liquid Federation’s board, reportedly identified Blockstream as the source when questioned about the funding.

“As stated many times, Blockstream,” Mow wrote in response to a question on X.

However, the federation has not published a detailed allocation of the replacement funds or explained whether other members contributed.

SideSwap’s November 3 statement thanked Blockstream and federation members for completing the recovery but declined to identify the funding source independently.

The restored balances establish that sufficient Bitcoin has returned to the reserve. They do not, by themselves, identify the owners of the wallets that supplied it.

Liquid Network swaps resume while direct withdrawals remain restricted

Liquid Network uses a system where BTC deposited on Bitcoin’s main blockchain is represented by LBTC on its sidechain.

Users can transfer LBTC within Liquid, while authorized federation members handle the process of converting it back into BTC.

Following the exploit, the federation suspended withdrawals and temporarily halted network activity while developers repaired the vulnerability.

As crypto.news previously reported, Liquid resumed block production in September before gradually restoring ordinary transactions.

The network later introduced updated authorization procedures and began an independent security review of Elements v23.3.4.

Under its October 20 recovery plan, the federation allowed participating providers to resume BTC/LBTC swaps while keeping direct peg-outs restricted.

SideSwap said its conversion service reopened on October 20, allowing customers to exchange LBTC for BTC at a 1:1 rate, less a 0.1% fee.

However, those payments currently come from SideSwap’s own Bitcoin wallet, which requires manual replenishment.

The provider warned that withdrawals may enter a queue when its available Bitcoin balance runs low.

Direct federation peg-outs remain subject to additional security and operational requirements, with no confirmed reopening date.

Federation plans governance changes and stronger safeguards

The federation said it intends to modernize its governance structure and introduce clearer responsibilities and oversight following the incident.

Its planned work includes additional technical and operational protections intended to prevent similar failures.

Blockstream previously released Elements v23.3.4 to address the vulnerability and introduced changes to the software’s transaction verification process.

The federation has been updating the authorization arrangements used by members who process withdrawals, including procedures involving offline Bitcoin keys.

The November statement promised further information about governance changes and security measures “in the coming weeks.”