Historical report: November 3, 2026, at 19:48:18 UTC+8.
The Liquid Federation said its bitcoin reserves had returned to full 1:1 backing for all LBTC, nearly two months after an exploit drained approximately 4,000 BTC—valued at about $320 million—from its Federation wallet.
Liquid Federation board member and former Blockstream executive Samson Mow identified Blockstream as the source of the bitcoin used to close the reserve gap. Restored backing, however, did not establish that every withdrawal restriction had ended.
How the reserve gap was closed
Following the September 6 exploit, the attacker returned roughly 3,400 BTC the next day after Blockstream patched the affected bridge nodes, but withheld about 600 BTC. Blockstream, led by Adam Back, later rejected the attacker’s demand for a 10% bug bounty in exchange for returning the remaining coins.
Mow reported a 50 BTC deposit into the Federation wallet on October 28, leaving 550 BTC outstanding. Another 300 BTC arrived on Monday, November 2, followed by 250 BTC later that day. Those deposits restored full backing, according to the report.
Reserve balances are published at liquid.network, and Liquid node operators can independently verify the backing.
Backing restored does not mean all restrictions were lifted
By the November 3 announcement, users had been able to swap BTC and LBTC through participating providers for several weeks. Direct Federation peg-outs had previously been restricted pending additional security checks, although some semi-automated peg-outs had resumed.
The announcement did not say whether the remaining restrictions had been lifted. That leaves a distinction between replenished reserves and fully restored withdrawal access.
What the incident report identified
Liquid’s September incident report traced the exploit to a bug involving cached range-proof verifications in Elements, the software underlying the network. The attacker created approximately 4,000 unbacked LBTC and used them to withdraw bitcoin through SideSwap, a Liquid wallet and trading platform that is also a Federation member with a peg-out authorization key.
Liquid said its network operators were not hacked and no keys were compromised.
Elements v23.3.4 was released on September 9 to address the vulnerability. Liquid resumed producing blocks later that day, and user transactions returned on September 10; Federation peg-outs remained disabled at that stage.
In its November 3 update, the Federation said it was preparing governance and oversight changes alongside additional technical and operational safeguards. It expected to share details in the following weeks, but those measures were not detailed in the supplied report.