Liquid’s bitcoin IOUs are fully backed again after a $320 million exploit

Every LBTC on the Liquid Network is backed by a real bitcoin again, almost two months after a software bug let an attacker drain nearly all of them.

Liquid is a Bitcoin sidechain run by a federation of firms led by Blockstream, used by exchanges and traders to move bitcoin faster than the main network allows. Users lock BTC with the federation and get LBTC in return, a token that’s supposed to be redeemable for one bitcoin at any time.

That backing broke on Sept. 6. A bug in Liquid’s software let an attacker mint about 4,000 LBTC with nothing behind them and redeem them for real bitcoin.

The bitcoin reserve dropped from about 4,205 BTC to 197, according to Blockstream’s incident report at the time. The attacker, who claimed to be a white hat, returned 3,400 BTC the next day, leaving about 600 BTC missing.

That hole is now closed. The Liquid Federation said on X on Monday that reserves were “fully restored, reestablishing 1:1 BTC backing for all LBTC,” after a final 250 BTC transfer. Anyone can check the balance on the network’s public dashboard, it said.

The federation didn’t say where those last 600 BTC, worth more than $40 million, came from.

Users have been able to swap BTC and LBTC at 1:1 through providers like SideSwap since late October. Direct withdrawals from the federation still run under what it called “enhanced operational controls,” and it promised more on governance changes “in the coming weeks.”