Liquid Federation said on Monday that the Bitcoin reserves of the Liquid Network have been fully restored after a self-proclaimed white-hat hacker drained most of the reserves two months ago.
The alliance stated that it has re-established the 1:1 Bitcoin collateral backing for all LBTC, the token representing Bitcoin on the Liquid network. It noted that this development followed the restoration of the 1:1 exchange rate between BTC and LBTC by the participants several weeks ago.
Liquid Federation wrote in the update:
Liquid Federation is pleased to announce that the network's Bitcoin reserves have been fully restored, re-establishing the 1:1 BTC backing for all LBTC.
This follows the restoration of the BTCLBTC exchange several weeks ago, after which it has been permitted…
Blockstream CEO Adam Back posted a screenshot of a dashboard on X showing an asset-to-liability match rate of 100% and a reserve gap of 0.00 BTC. The consortium stated that users running their own Liquid nodes can directly verify the federation’s reserves.
The alliance did not explain how the gap caused by the vulnerability was filled.
Liquid, launched by Blockstream in 2018, is a Bitcoin sidechain—an independent blockchain running parallel to Bitcoin—designed to enable faster and more private transactions. Users lock their BTC in a wallet controlled by a federation, a group of exchanges and other crypto companies that operate the network, and receive an equivalent amount of LBTC in return.
When asked on X what could prevent similar attacks from happening again, Back outlined three hardened “layers of defense”: the updated peg-out authorization key is now stored in a cold hardware wallet; the proof verification cache has been disabled and a vulnerability in the nodes has been patched; and the consensus rules have been strengthened to “fail closed.” He added that the network has undergone multiple third-party audits.
Back wrote: "Another lesson: Be skeptical of AI-recommended fixes (don’t blindly trust—verify)."
Back mentioned on Bloomberg TV on October 20 the growing role of AI in security, noting that over the past few months there had been “a wave of AI-assisted security analysis.” He said, “AI is certainly a tool that helps develop and protect code, but it can also be used to identify vulnerabilities,” adding that this has “affected many companies in the industry.” At the time, he stated that the hacked funds were still “under investigation.”
The alliance stated that it is modernizing Liquid’s governance structure, clarifying responsibilities and oversight, and adding further technical and operational safeguards, with more details to be announced in the coming weeks.
September vulnerability incident
On September 6, a self-proclaimed white-hat hacker withdrew approximately 4,000 BTC from Liquid’s multisig wallet, valued at around $320 million at the time, and communicated with Blockstream via PGP-signed messages embedded in Bitcoin transactions.
The next day, after Blockstream stated that the bridging nodes for Liquid had been patched, they returned 3,400 BTC, worth approximately $269 million, but retained about 598 BTC. Ledger’s Chief Technology Officer, Charles Guillemet, said that if the remaining tokens were intended as a negotiated reward, the arrangement looked “more like ransomware than white-hat hacking.”
Blockstream subsequently refused to pay a ransom for the remaining bitcoins. The company stated, "Taking assets without authorization and refusing to return them is a crime, not responsible disclosure. This is not white-hat behavior. This is theft."