Liquid Network Backing Restored After $320M Exploit

Liquid Network backing has been restored to a 1:1 ratio after a September exploit left the Bitcoin sidechain short of reserves, the Liquid Federation announced on November 3. CoinDesk reported that direct Federation withdrawals remained subject to enhanced operational controls. CoinDesk also said the Federation did not disclose the source of the bitcoin used to fill the shortfall. The Block separately reported that Blockstream provided the funds.

• The Federation says its reserves now provide 1:1 backing for all Liquid Bitcoin, or LBTC.
• The incident began on September 6, when a vulnerability allowed an attacker to create about 4,000 unbacked LBTC and withdraw approximately 4,000 BTC, according to Blockstream’s incident assessment.
• CoinDesk reported that a final transfer of 250 BTC closed the remaining reserve gap. The Block reported that Blockstream provided funds for the restoration.
• The Federation’s October recovery update described full backing as a requirement before controlled reactivation of Federation peg-outs.
• CoinDesk reported on November 3 that direct Federation withdrawals were still subject to enhanced operational controls. The supplied reports do not confirm a timetable for changing those controls.

Timeline of the Liquid Network backing recovery

1. September 6, 2026: At 13:53 UTC, an attacker exploited an Elements rangeproof-verification-cache vulnerability to create about 4,000 unbacked LBTC in Liquid block 4,050,336. Blockstream’s assessment says the attacker used the peg-out process to withdraw approximately 4,000 BTC. Federation reserves fell from about 4,205 BTC to 197 BTC.
2. September 7, 2026: Blockstream deployed an emergency patch. The attacker returned 3,400 BTC to the Federation wallet that day. Blockstream had halted Liquid’s bridge nodes on September 6.
3. September 9 and 10, 2026: Blockstream released the hardened Elements v23.3.4 fix on September 9. Liquid transactions resumed on September 10, but peg-outs remained disabled during the recovery.
4. September 23, 2026: Blockstream’s assessment put the outstanding amount at approximately 602 BTC. It also said other Liquid-issued assets, including USDt and DePix, were unaffected.
5. October 20 to November 3, 2026: In its October 20 update, the Federation said BTC-to-LBTC swaps were being enabled through participating providers. On November 3, it announced that reserves were fully restored. CoinDesk reported that the final 250 BTC transfer closed the shortfall.

Background on Liquid Network backing

Liquid is a Bitcoin sidechain, and LBTC is backed by the reserves in the reported 1:1 relationship. After the exploit, the Federation’s reserves fell below that level. Peg-outs remained disabled during the recovery, while network transactions resumed on September 10.

Blockstream’s assessment identifies an Elements rangeproof-verification-cache vulnerability as the cause of the incident. The assessment reported that other Liquid-issued assets, including USDt and DePix, were unaffected. It also described the software fix and temporary network restrictions in its security incident assessment.

The Federation’s staged recovery update said BTC-to-LBTC swaps were being enabled through participating providers without protocol-imposed volume limits, while full backing remained a prerequisite for controlled peg-outs. These are separate service statuses: the return of network transactions did not itself confirm that Federation peg-outs had resumed.

Reactions and immediate market context

Blockstream CEO Adam Back said Liquid’s defenses had been hardened, Decrypt reported. Back also warned developers not to trust AI-suggested fixes blindly. The supplied reporting does not say AI tools played a role in the exploit.

The supplied market data does not establish a market move tied specifically to the reserve announcement. Bitcoin traded at $77,001 at 11:59 UTC on November 3, down 1.04% over the preceding 24 hours, according to CoinGecko data. The Crypto Fear & Greed Index was 26, classified as Fear, on November 3, according to Alternative.me. Those figures describe broader market conditions, not a measured reaction to the Liquid update.

The incident exposed a software vulnerability and was followed by restrictions on Federation peg-outs. On November 3, direct Federation withdrawals remained subject to enhanced operational controls. The reserve restoration addresses the reported shortfall, but the supplied reporting does not establish that it removes future software or withdrawal risks.

What to watch next

The immediate question is whether the Federation will announce a timetable for easing enhanced controls and reactivating direct peg-outs. The October update linked that process to full backing, now reported as restored, but the November coverage does not confirm that the controls have been removed.

A further Federation notice could clarify withdrawal arrangements, any limits or conditions, and how the reserves are verified. CoinDesk said the Federation had not disclosed the source of the bitcoin used to close the shortfall, while The Block reported that Blockstream provided funds. Liquid Network backing is now reported as complete, while the recovery’s operational next phase is still developing.

FAQ

What does Liquid Network backing mean?

It refers to the bitcoin reserves held to support LBTC. The Federation says reserves now provide 1:1 backing, meaning one BTC for each LBTC.

What caused the Liquid Network exploit?

Blockstream’s assessment says an attacker exploited an Elements rangeproof-verification-cache vulnerability on September 6, 2026, to create about 4,000 unbacked LBTC and use the peg-out process to withdraw bitcoin.

Are Liquid peg-outs fully available again?

That has not been confirmed. CoinDesk reported on November 3 that direct Federation withdrawals remained subject to enhanced operational controls. The supplied reporting does not confirm when those controls will change.

Sources

• Liquid Network Security Incident Assessment (blog.liquid.net)
• Liquid Network restores full bitcoin backing following $320 million exploit (The Block)
• Liquid Network Restores Full Bitcoin Backing Two Months After $320M Exploit (Decrypt)

This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrencies are highly volatile; always do your own research before investing.