Liquid Restores Full Bitcoin Backing After $320 Million Security Exploit

Liquid Restores Full Bitcoin Backing After September’s $320 Million Exploit

A final transfer of 250 BTC has covered the remaining reserve shortfall on the Liquid Network following a September software vulnerability. However, the federation operating the Bitcoin sidechain has yet to reveal who supplied the funds needed to restore its reserves.

All LBTC tokens issued on Liquid are now backed by an equivalent amount of real Bitcoin, nearly two months after a software flaw allowed an attacker to drain most of the network’s reserves.

Liquid is a Bitcoin sidechain operated by a federation of companies led by Blockstream. It enables exchanges and traders to transfer Bitcoin more quickly than transactions on the main blockchain. Users deposit BTC with the federation and receive LBTC in return, with each token designed to be redeemable for one Bitcoin.

The system’s one-to-one backing was compromised on September 6, when a software bug enabled an attacker to create approximately 4,000 LBTC without depositing any Bitcoin. The attacker subsequently redeemed those tokens for actual BTC.

According to Blockstream’s incident report, the network’s Bitcoin reserves plunged from approximately 4,205 BTC to just 197 BTC following the exploit. The attacker, who identified themselves as a white-hat hacker, returned 3,400 BTC the following day, leaving a shortfall of roughly 600 BTC.

The remaining deficit has now been addressed. The Liquid Federation announced on X on Monday that its reserves had been fully replenished, restoring one-to-one Bitcoin backing for every LBTC after receiving a final transfer of 250 BTC.

The federation also said users could independently verify the reserve balance through Liquid’s publicly accessible dashboard.

However, it has not disclosed the source of the remaining Bitcoin used to cover the approximately 600 BTC shortfall, which was worth more than $40 million.

Users have been able to exchange BTC and LBTC at a one-to-one rate through service providers such as SideSwap since late October. Nevertheless, direct withdrawals through the federation remain subject to what it describes as “enhanced operational controls.”

The federation also indicated that further details about governance changes would be shared “in the coming weeks.”