The Liquid Federation announced on Tuesday that the Liquid Network has restored full 1:1 Bitcoin backing for all LBTC tokens, nearly two months after a software exploit drained approximately $320 million in Bitcoin from the sidechain.
Reserve recovery was completed after several deposits, including a final 250 BTC transfer on November 2. Blockchain records showed roughly 4,268.95 BTC backing an equivalent amount of LBTC when the shortfall closed, and updated figures on November 3 showed about 4,270.54 BTC backing the same amount of LBTC.
The incident began on September 6, when an attacker exploited a bug involving cached range proof verifications in Elements, the software that runs Liquid Network. The attacker created approximately 4,000 unbacked LBTC and withdrew roughly 4,000 BTC through SideSwap, a Federation member with a peg-out authorization key. Liquid said its operators were not hacked and no keys were compromised.
The attacker returned about 3,400 BTC the next day after Blockstream patched affected bridge nodes, but withheld around 600 BTC. Blockstream later rejected the attacker’s demand for a 10% bug bounty, saying it would not be a party to the precedent of paying ransom related to open-source software.
Reserve restoration accelerated in late October with deposits of 2.5 BTC and 50 BTC, followed by 300 BTC and 250 BTC on November 2. Liquid Federation board member Samson Mow identified Blockstream as the source of the replacement funds, writing on X: 'As stated many times, Blockstream.'
BTC and LBTC swaps have resumed through participating providers, with SideSwap reopening its conversion service on October 20 at a 1:1 rate, less a 0.1% fee. However, direct Federation peg-outs remain restricted pending additional security and operational requirements, and no reopening date has been confirmed.
The Liquid Federation said it is preparing changes to governance and oversight, as well as additional technical safeguards, with further details expected in the coming weeks. Elements v23.3.4 was released on September 9 to address the vulnerability.
