Liquid restores 1:1 LBTC backing; the federation hasn't said who paid

The Liquid Federation says every LBTC on the Liquid Network is backed one-to-one by bitcoin again, nearly two months after a software bug let an attacker pull about 4,000 BTC out of the reserve. The federation has not said who supplied the last 600 BTC, worth more than $40 million, CoinDesk reported.

What the federation confirmed

Liquid is a Bitcoin sidechain run by a federation of firms led by Blockstream. Users lock BTC and receive LBTC, a token that is supposed to be redeemable for one bitcoin at any time. The federation said reserves are "fully restored, reestablishing 1:1 BTC backing for all LBTC" after a final 250 BTC transfer.

The gap dates to Sept. 6, when an attacker exploited a flaw in how Elements, the software behind Liquid, cached proof checks, and created about 4,000 LBTC with nothing behind them. Blockstream's incident report says the reserve fell from about 4,205 BTC to 197 BTC. The attacker returned 3,400 BTC the next day, which left roughly 602 BTC missing. The theft added to the industry's recent losses to hacks.

The restored backing can be checked. A look at the public figures on liquid.network at 16:10 UTC on Nov. 3 showed reserves of about 4,271.6 BTC against the same amount in its peg total, with reserves ahead by 52 satoshis. Operators of Liquid nodes can verify the backing on their own, The Block noted.

Who covered the last 600 BTC, and what is still limited

The federation's announcement did not name a source for the bitcoin. Samson Mow, a Liquid Federation board member and former Blockstream executive, answered the question on X. "As stated many times, Blockstream," he wrote, according to The Block. That is his statement, not one from the federation. The Block also reports that Mow flagged deposits of 50 BTC on Oct. 28, then 300 BTC and 250 BTC on Nov. 2. Blockstream had earlier refused the attacker's demand for a 10% bounty in exchange for the remaining coins.

Recoveries after large exploits do not all end this way. Balancer Labs said it would shut down six months after losing $128M to an exploit.

For users, swaps between BTC and LBTC at 1:1 have worked through providers such as SideSwap since late October. Direct withdrawals from the federation still run under what it called "enhanced operational controls," and The Block says the announcement did not say whether those limits have been lifted. SideSwap, whose peg-out service paid out about 4,000 BTC in September, has since said it kept its signing key online and set no size limit on withdrawals, according to Blockstream's report.

The federation said it is preparing changes to governance and oversight, plus further technical safeguards, and promised details "in the coming weeks."