Liquid's Bitcoin Backing Is Whole Again After 550 BTC Arrive

Liquid's reserves are back where they sat before September. The Liquid Federation said on Tuesday that the sidechain's bitcoin holdings have been fully restored and that every LBTC token is again backed one for one. About 4,000 BTC, put at roughly $320 million at the time, had left the network on 6 September. Two deposits on Monday closed the gap, 300 BTC and then 250 BTC the same day. What the Federation has not said is who paid for them.

Who put the coins back

Samson Mow, a board member of the Federation and a former Blockstream executive, is the one naming the source. Asked on X on 2 November where the replacement bitcoin was coming from, he answered: "As stated many times, Blockstream." The Block and Cryptowisser both carry that line in the same words. Neither carries a comment from Blockstream itself, and Cryptowisser describes the company's role as reported. Blockstream builds the software Liquid runs on and refused the attacker a 10% bounty in September.

The terms are blank too. Nobody has said whether the coins were a payment, a reimbursement or something else.

The arithmetic does not close

Three deposits are on the record and all of them trace to Mow. Fifty BTC arrived on 28 October, which he said left about 550 outstanding. Then 300 BTC on Monday, then 250 BTC later the same day. Added up that is 600, and The Block separately puts what the attacker kept at about 600 BTC. Cryptowisser's own summary line says 550 BTC was deposited across late October and early November, a figure its own body contradicts. The two readings do not reconcile, and we could not establish which total the Federation itself works from. Blockonomi, which carries the announcement at length, prints no bitcoin figure at all.

What September actually broke

One account read here describes the flaw. The Block puts the root cause in Elements, the open-source base Liquid is built on, in a bug involving cached range proof verifications. On that telling the attacker minted about 4,000 unbacked LBTC and used them to pull real bitcoin out through SideSwap, a Federation member holding a peg-out authorization key. A peg-out is the step that turns LBTC back into bitcoin on the main chain. Liquid said its operators were not hacked and no keys were compromised. The same account dates the fix to Elements v23.3.4 on 9 September, with block production resuming that day and user transactions the next. Nothing else read in this sweep corroborates any of it.

The attacker gave most of it back. About 3,400 BTC returned on 7 September, after Blockstream patched the affected bridge nodes, and the senders kept a share for themselves.

Peg-outs are the loose end

Whether the Federation's remaining withdrawal restrictions have come off went unaddressed in Tuesday's announcement, on The Block's reading, though some semi-automated peg-outs have resumed. Blockonomi covers only BTC and LBTC swaps, which it says run through participating providers it does not name. All three accounts agree swapping has worked for several weeks. None of them gives a date for when it reopened.

Governance is the next thing the Federation says it will change, along with oversight and further technical and operational safeguards, with details promised in the coming weeks. It thanked the Bitcoin community, users and partners for their "patience, understanding, and continued engagement".

"Restoring full bitcoin backing marks an important milestone, but our work continues," the Federation said.

Reserves can be checked against that claim. The Federation points users to proof-of-reserves on their own Liquid nodes or its public dashboard, which Blockonomi reports and the other two accounts do not mention. Two months on, the attacker is unnamed in every account read here.