Liquid Network Restores Bitcoin Reserves Following $320 Million Security Breach

The Liquid Federation confirmed on November 3 that its Bitcoin reserves had returned to full coverage, restoring the one-to-one backing required for LBTC, a digital asset representing Bitcoin held within the network. The announcement follows a September security incident in which attackers withdrew approximately 4,000 BTC from the federation's reserves, before returning most of the funds and retaining nearly 600 BTC.

Blockstream CEO Adam Back confirmed the recovery by sharing data from Liquid's public monitoring dashboard, which showed the network's assets matching its liabilities with no remaining Bitcoin deficit. The federation said users operating their own Liquid nodes can independently verify the reserve figures, providing transparency over the assets supporting tokens in circulation.

Liquid Network Recovers From September Bitcoin Exploit

The security breach occurred on September 6, when attackers exploited a vulnerability in Elements, the open-source software underpinning Liquid Network. The flaw involved the caching of cryptographic range proof verifications, allowing the attackers to create approximately 4,000 LBTC without depositing the equivalent amount of Bitcoin.

The unauthorised tokens were subsequently used to withdraw Bitcoin through SideSwap, a cryptocurrency trading platform participating in the Liquid Federation. The operation resulted in approximately $320 million worth of Bitcoin leaving the network's reserves, creating a substantial shortfall between the amount of LBTC in circulation and the assets available to support it.

The individuals responsible described themselves as white-hat hackers and contacted Blockstream through cryptographically signed messages embedded in Bitcoin transactions. Following the deployment of an initial security patch, they returned approximately 3,400 BTC on September 7 but retained around 598 BTC, which was worth tens of millions of dollars at the time.

Blockstream subsequently rejected demands for a substantial financial reward in exchange for returning the remaining funds, arguing that withholding assets obtained through unauthorised access did not constitute responsible security research. The company maintained that the outstanding cryptocurrency should be returned without conditions, while continuing efforts to restore the network's financial backing.

The reserve shortfall has now been eliminated following several Bitcoin deposits during late October and early November. Liquid Federation board member Samson Mow identified Blockstream as the source of the replacement funds, although the federation's announcement did not provide a detailed breakdown of the financing arrangements.

Security Upgrades Strengthen Bitcoin Custody Infrastructure

Following the attack, Blockstream introduced several changes to the systems responsible for securing and authorising transactions across Liquid Network. These include replacing the cryptographic keys used to approve Bitcoin withdrawals, with the updated credentials now maintained in offline hardware wallets rather than more exposed infrastructure.

The company has also disabled the affected proof verification caches and implemented software corrections addressing the vulnerability exploited in September. Additional changes to the network's consensus rules are designed to make transaction validation fail safely when unexpected conditions arise, preventing potentially invalid transactions from being approved.

Back said the network's security arrangements had been strengthened across three principal areas, supported by multiple independent third-party audits. He also highlighted the risks associated with relying too heavily on artificial intelligence when developing or reviewing security-sensitive software, warning developers to treat AI-generated recommendations "with suspicion" rather than accepting them without independent verification.

The comments follow Back's earlier observations about the growing role of artificial intelligence in cryptocurrency cybersecurity. During an October interview with Bloomberg Television, he described increasing use of AI-assisted security analysis across the industry, acknowledging that the technology can help developers identify vulnerabilities while also potentially enabling attackers to discover weaknesses more efficiently.

Bitcoin Withdrawals Resume As Governance Review Continues

Launched by Blockstream in 2018, Liquid Network is a Bitcoin sidechain designed to facilitate faster settlement and more confidential transactions. Users deposit Bitcoin into a federation-controlled wallet and receive an equivalent amount of LBTC, which can then be transferred across the network before being redeemed for the underlying cryptocurrency.

The restoration of full reserves represents a significant milestone in the network's recovery, although some operational restrictions remain in place. Bitcoin-to-LBTC conversions have been available through participating providers for several weeks, while direct federation withdrawals remain subject to additional security controls as normal functionality is gradually restored.

The Liquid Federation has also announced plans to modernise its governance framework following the incident, introducing clearer responsibilities, stronger oversight and additional operational safeguards. Further details are expected in the coming weeks as the organisation continues reviewing its security infrastructure and procedures for managing reserve assets.

The September exploit highlighted the risks associated with blockchain interoperability and the importance of maintaining reliable verification mechanisms for assets represented across different networks. Although the underlying Bitcoin blockchain was not compromised, the vulnerability in Liquid's supporting software demonstrated how weaknesses in sidechain infrastructure can expose substantial reserves to theft.

With its Bitcoin backing restored, Liquid Network has addressed the immediate financial shortfall caused by the attack. However, the federation's ongoing governance reforms and additional security measures will remain important as it seeks to rebuild confidence in the infrastructure supporting LBTC transactions.