Liquid Network restores full bitcoin backing following $320 million exploit

The Liquid Federation announced Tuesday that the sidechain's bitcoin reserves are back to full 1:1 backing for all LBTC, nearly two months after an exploit in which approximately $320 million in bitcoin was withdrawn from the network.

Users have been able to swap Bitcoin (BTC) and LBTC again for several weeks through participating providers. Direct Federation peg-outs were previously restricted pending additional security checks, although some semi-automated peg-outs have since resumed. Tuesday's announcement did not say whether the remaining restrictions had been lifted. Reserve balances are published at liquid.network, where Liquid node operators can also verify the backing themselves.

"We extend our sincere appreciation to the Bitcoin community, Liquid users, and ecosystem partners for their patience, understanding, and continued engagement throughout the recovery process," the Liquid Federation said. "Your support and involvement has been instrumental as we worked to restore the network's reserves and strengthen its underlying infrastructure."

About 4,000 BTC was taken from Liquid's Federation wallet in the Sept. 6 exploit. The attacker sent back roughly 3,400 BTC the next day after Blockstream, the developer of Liquid Network's underlying technology, patched the affected bridge nodes, but withheld about 600 BTC. Adam Back-led Blockstream later rejected the attacker's demand for a 10% bug bounty in exchange for returning the remaining coins.

"We will not be a party to the precedent that open-source software developed for the good of the Bitcoin community should subject its developers to paying a ransom that far exceeds their economic participation," Blockstream said at the time.

Blockstream's bitcoin deposits close reserve gap

Liquid Federation board member and former Blockstream executive Samson Mow reported a 50 BTC deposit into the Federation wallet on Oct. 28, leaving 550 BTC outstanding. Another 300 BTC arrived on Monday, followed by a further 250 BTC later that day, bringing the reserves back to full backing. Mow identified Blockstream as the source of the funds. "As stated many times, Blockstream," he wrote on X when asked where the bitcoin was coming from.

Liquid's September incident report traced the exploit to a bug involving cached range proof verifications in Elements, the underlying software used to run the Liquid Network. The attacker was able to create approximately 4,000 unbacked LBTC, which were then used to withdraw bitcoin through Liquid Network wallet and trading platform SideSwap, a Federation member with a peg-out authorization key. Liquid said its network operators were not hacked and no keys were compromised. 

Elements v23.3.4 was released on Sept. 9 to address the vulnerability. Liquid resumed producing blocks later that day, with user transactions returning on Sept. 10, although Federation peg-outs remained disabled at that stage.

In its latest update, the Federation said it was preparing changes to governance and oversight, as well as additional technical and operational safeguards. It expects to share further details in the coming weeks.