Liquid Network restores full bitcoin backing after $320M exploit — with Blockstream covering the shortfall

The Liquid Federation said Tuesday that its sidechain's bitcoin reserves are back to full 1:1 backing for all LBTC, nearly two months after a September exploit drained roughly 4,000 BTC — about $320 million — from the Federation wallet, according to The Block.

The gap that lingered was closed not by the attacker but by Blockstream, the company behind Liquid's underlying technology. Federation board member and former Blockstream executive Samson Mow reported a 50 BTC deposit into the Federation wallet on Oct. 28, leaving 550 BTC outstanding. Another 300 BTC arrived Monday, followed by 250 BTC later the same day, restoring full backing, The Block reported. Asked on X where the coins came from, Mow answered: "As stated many times, Blockstream."

The Sept. 6 exploit traced to a bug involving cached range proof verifications in Elements, the software Liquid runs on. Per Liquid's own incident report, the attacker minted roughly 4,000 unbacked LBTC and used them to withdraw real bitcoin through SideSwap, a Federation member holding a peg-out authorization key. Liquid said no operator was hacked and no keys were compromised. The attacker returned about 3,400 BTC the next day after Blockstream patched the affected bridge nodes, but kept roughly 600 BTC. Adam Back–led Blockstream then rejected the attacker's demand for a 10% bug bounty to return the rest, saying it would not "pay a ransom" over open-source software. Elements v23.3.4 shipped Sept. 9; blocks resumed that day, user transactions Sept. 10.

Key facts

• Full 1:1 LBTC backing restored, announced Tuesday, Nov. 3, 2026 (Liquid Federation, via The Block).
• 4,000 BTC ($320M) withdrawn in the Sept. 6 exploit; ~3,400 BTC returned Sept. 7; ~600 BTC withheld (The Block).
• Reserve top-ups: 50 BTC on Oct. 28, 300 BTC and 250 BTC on Monday, Nov. 2 — sourced to Blockstream per Mow (The Block).
• Cause: cached range proof verification bug in Elements; abused via SideSwap's peg-out key; patched in Elements v23.3.4 (Liquid incident report, via The Block).
• Reserve balances published at liquid.network for independent node-operator verification.

The real-world read

Users are whole, but read who made them whole: Blockstream appears to have eaten the roughly 600 BTC the attacker never gave back — the thief still walks away with it. That's a company subsidizing its own ecosystem's recovery, not a full recovery of stolen funds. The "fully restored" framing comes from the Federation itself; it's verifiable by node operators, which is to Liquid's credit, but it's still a self-report from an interested party. Note too that Mow is both a Federation board member and a former Blockstream exec confirming Blockstream as the source — not an independent attestation. And Tuesday's announcement pointedly did not say whether direct Federation peg-out restrictions, imposed after the exploit, have actually been lifted. Promised governance and oversight changes remain unspecified, "in the coming weeks."

This is not financial advice.

Sources

• The Block (Tier 2, reputable secondary), Nov. 3, 2026 — reporting on the restored backing, the deposit timeline, Mow's attribution to Blockstream, the exploit mechanics and Blockstream's ransom refusal. The Block cites the Liquid Federation's announcement and incident report, and Samson Mow's posts on X as primary sources.