Liquid Network Restores Full Bitcoin Backing Two Months After $320M Exploit

What it is

On 3 November 2026 the Liquid Federation said Liquid Network's Bitcoin reserves are fully restored and all LBTC is backed 1:1 again. This follows the 6 September 2026 withdrawal of about 4,000 BTC (roughly $320M) from the federation wallet. Blockstream CEO Adam Back posted a dashboard screenshot showing assets matching liabilities at 100% and a reserve deficit of 0.00 BTC.

How it works

The attackers described themselves as white hats. They communicated with Blockstream through PGP-signed messages embedded in Bitcoin transactions. On 7 September they returned 3,400 BTC (about $269M) after Blockstream said the bridge nodes had been patched, and they kept roughly 598 BTC. BTC to LBTC swaps at 1:1 through participating providers resumed several weeks before the announcement.

What to do

Users running their own Liquid nodes can check the federation's reserves directly, so the 1:1 claim does not have to rest on the dashboard screenshot. The page gives no command or procedure for this check.

Back named three defences against a repeat:

• Peg-out authorization keys were refreshed and are now held in cold hardware wallets.
• Proof validation caches are disabled, together with a bug fix for nodes.
• Consensus rules are hardened to "fail closed".

Back also said the network has been through multiple third-party audits. The page does not name the auditors or give node versions.

Caveats

• The federation did not say how the shortfall left by the hack was covered. Whether the 598 BTC was recovered, replaced or absorbed is not stated.
• Ledger CTO Charles Guillemet said that if the kept coins were a negotiated reward, it looked "more like extortion than white-hat hacking." Blockstream refused to pay a ransom and called the act theft.
• Back's remark on AI is a lesson, not a finding: "treat with suspicion (don't trust, verify) AI suggested fixes." The page does not say AI-suggested fixes played a part in this incident. On 20 October, Back told Bloomberg Television that "a wave of AI-assisted security analysis" had been affecting many companies in the sector.
• The federation said it is modernizing governance, with clearer responsibilities and oversight, and will give details in the coming weeks.
• The page does not describe the vulnerability itself.