Liquid restores full bitcoin backing after $320 million exploit

The Liquid Federation said on Monday that every LBTC token is backed one to one by bitcoin again, almost two months after a software bug let an attacker pull roughly 4,000 BTC, worth about $320 million at the time, out of its reserves.

Liquid announced the fix in a post on X. Anyone can check the math on its public dashboard. Unchained did, on Tuesday morning, and found 4,270.54 BTC held against 4,270.54 BTC pegged into the network, a gap of 52 satoshis. That is a rounding error. The peg holds.

What broke in September

A bitcoin sidechain run by a federation of companies, Liquid is a faster side-ledger where people lock up BTC and receive LBTC in return. Those IOUs move quickly and settle in minutes, which traders and exchanges like. The whole model rests on one promise: every LBTC can be swapped back for a real bitcoin. That promise broke on September 6. A flaw in Elements, the open-source software behind the chain, let the attacker mint about 4,000 LBTC that no bitcoin sat behind. Liquid's own incident report, published two days later, traced the fault to the way its nodes cached a verification step, which waved the fake tokens through. Those tokens were then swapped for real bitcoin through SideSwap, a Federation member that holds a peg-out key.

SideSwap pushed back on any blame. It said the trouble came from faulty LBTC created by the Elements bug, not from its own systems. Reserves dropped from about 4,205 BTC to 197 BTC before operators halted the chain. Block production resumed on September 10 without transactions while the network was watched. Peg-outs stayed frozen for weeks. Users could see their balances but could not pull coins back to the main chain.

The attacker, who claimed to be a white hat, returned 3,400 BTC the next day. The transfer reached a Federation address at 16:09 UTC on September 7, about 85 percent of the haul. Roughly 598.5 BTC stayed missing, worth more than $40 million by CoinDesk's count on Monday. Swaps between BTC and LBTC came back at one to one through SideSwap in late October, well before the reserve was whole.

Who covered the shortfall

Liquid has not said who put up the missing bitcoin. Its restoration post named no source and gave no figure for the fresh money that went in. That silence is the part worth watching. A peg is only as good as the coins behind it. Holders deserve to know whether those coins came from an insurer, a backer, or a loan, because each answer carries a different risk if the gap ever opens again.

Samson Mow filled in part of the blank. Mow, a Liquid Federation board member who used to work at Blockstream, said on X that Blockstream supplied the funds. Blockstream builds the Liquid software and runs much of its plumbing. Accounts of the exact transfers do not match. One describes a single 250 BTC payment closing the hole. Another lists a 50 BTC deposit on October 28 and two larger ones after it. Neither Liquid nor Blockstream has published a full ledger.

September's loss reopened an old argument about federated pegs. Liquid spreads control across dozens of members, which is meant to stop any single one from running off with the coins. It did not stop a bug in shared software from minting tokens out of thin air. Supporters say the design still worked, because operators caught the problem, halted the chain, and clawed back most of the funds within a day. Critics say a system that needed a patron to cover a $40 million hole is not as trustless as the pitch suggests.

White hat, or something closer to extortion

Security researchers split on what to call the person who took the coins. Returning most of the money fast looks like a white hat, a hacker who breaks in to make a point and hands the funds back. The attacker even spoke to Blockstream through PGP-signed notes tucked inside bitcoin transactions, and Blockstream said it had patched the bug before most of the coins came home. Keeping almost 600 BTC fits that picture less well.

Charles Guillemet, chief technology officer at hardware-wallet maker Ledger, said that if those coins were a negotiated reward, the setup looked "more like extortion than white-hat hacking." Blockstream went further. "Taking assets without authorization and withholding their return is a crime, not responsible disclosure," the company said. Not everyone will agree on the label. The money that came back does not erase the money that did not.

Adam Back, Blockstream's chief executive, drew a narrower lesson. He posted a dashboard screenshot showing assets matching liabilities at 100 percent, with a reserve deficit of zero. "And lesson: treat with suspicion (don't trust, verify) AI suggested fixes," Back wrote, pointing at reports that the first bug fix leaned on AI help. The loss also fits a rough autumn for bitcoin plumbing, a stretch that saw a hot-wallet breach push BTCPay Server to tell users to shut down.

What to watch

Liquid says the backing is whole, but the cleanup is not. Direct withdrawals from the Federation still run under what it calls enhanced operational controls, so the network is not fully back to normal. The group has promised governance changes in the coming weeks, with clearer lines of responsibility, new technical safeguards, and a fresh look at who can authorize peg-outs. The Federation has also signaled a wider membership review, though it has set no date. Swap users can already move between BTC and LBTC at one to one.

Two questions sit open. Who paid to make LBTC holders whole, and on what terms. And whether a chain that leans on a small group of trusted members can promise this will not repeat. Liquid holds only a sliver of bitcoin's wrapped supply, far less than the big custodial tokens, so the damage stayed boxed in. Next time it might not.