Liquid, the Bitcoin sidechain run by the Liquid Federation, says every L-BTC in circulation is once again backed 1:1 by bitcoin, almost two months after a flaw in Elements allowed unbacked tokens to be minted. The restoration is a necessary step, but direct federation withdrawals remain restricted and wallet refills are still manual.
🔑 Key takeaways
- Full 1:1 backing announced: 4,268.95 units in reserve against 4,268.95 L-BTC in circulation per the Liquid explorer, or 100.00%.
- The shortfall was filled with transfers of 50 BTC, 300 BTC and 250 BTC, attributed to Blockstream by several sources.
- Direct federation withdrawals remain subject to enhanced operational controls.
- Incident figures (about 4,000 L-BTC, about $320 million) are not reconciled across sources.
Full Backing Announced, but the Snapshots Do Not Match
The Liquid Federation announced that the network’s bitcoin reserves had been fully restored, bringing backing to 1:1 per BTC for all L-BTC. Liquid is a sidechain launched by Blockstream in 2018. Users lock BTC in a wallet controlled by the Federation, a group of exchanges and other crypto companies, and receive the same amount in L-BTC. The network runs alongside Bitcoin to offer faster and more confidential transfers.
Two public snapshots support the return to full backing. According to the Liquid explorer cited by The Defiant, both reserve and circulating supply stood at 4,268.95 units around 7:08 p.m. Eastern on November 2, implying 100.00% coverage after dividing unrounded balances. The same source estimated coverage at 94.14% earlier that day. SideSwap published a later snapshot the next morning showing 4,270.54 BTC in reserve against 4,270.54 L-BTC in circulation.
| Source | Timing | Reserve / supply (L-BTC) | Coverage |
|---|---|---|---|
| Liquid explorer (The Defiant) | Nov. 2, around 7:08 p.m. ET | 4,268.95 / 4,268.95 | 100.00% |
| Liquid explorer (The Defiant) | Nov. 2, earlier that day | n.a. | 94.14% (estimated) |
| SideSwap | Nov. 3, morning | 4,270.54 / 4,270.54 | 100.00% |
The two readings do not refer to the same moment, and no source reconciles the 1.59-unit gap between them. The timestamps also diverge: the Federation dated its statement November 3, while The Defiant placed the announcement on the evening of November 2, with no explanation provided. Reserves remain verifiable by operators of their own Liquid nodes and on a public dashboard.
A 600 BTC Shortfall Filled by Transfers Attributed to Blockstream
According to Cryptopolitan, 50 BTC was deposited on October 28, leaving 550 BTC to cover. Transfers of 300 BTC and 250 BTC followed on November 2, hours apart, to restore parity. Forklog describes the same flows as three tranches of 50, 300 and 250 BTC, totalling the roughly 600 BTC that remained after the attacker returned 3,400 BTC. Both accounts are consistent if the remaining 598 BTC is rounded to 600 and the 50 BTC deposit is counted separately.
“As I’ve said many times, Blockstream.”
Samson Mow, founder of JAN3
A dashboard screenshot shared by Adam Back, CEO of Blockstream, shows assets and liabilities at 100% and a reserve deficit of 0.00 BTC. However, the Federation’s statement does not explain where the funding came from, and Yahoo Finance noted that it did not describe how the shortfall was covered. The attribution to Blockstream therefore rests partly on Mow’s remarks. Sources describe him variously as a board member of Blockstream and founder of JAN3, and as a Liquid Federation member and former Blockstream executive.
Anatomy of an Exploit: A Flaw in Elements’ Range Proof Cache
The exploit dates to September 6, 2026. Elements, the software underlying Liquid, contained a flaw that allowed roughly 4,000 L-BTC to be created without backing. The problem sat in a range proof validation cache whose key included neither the asset commitment nor the scriptPubKey, the script that locks the funds. A proof already validated could therefore be reused in a context where it was no longer valid.
These L-BTC were used to extract real BTC through SideSwap’s withdrawal service, which relies on authorisation keys. No Federation operator and no private key was compromised, thanks in part to the Federation’s 11-of-15 multisignature threshold and SideSwap’s authorisation keys.
The attacker, who described themselves as a white-hat hacker, returned 3,400 BTC on September 7 and kept about 598 BTC. They then demanded a 10% bug bounty on the remaining balance. Blockstream refused. Messages sent to the company were PGP-signed and embedded in Bitcoin transactions. An independent analysis indicates the attacker reverse-engineered the vulnerability from a GitHub commit with a public title, before any production node had been updated.
| Source | Volume cited | Value cited |
|---|---|---|
| Forklog, Yahoo Finance | About 4,000 BTC withdrawn | About $320 million |
| Blockstream incident assessment | About 4,000 unbacked L-BTC, including nearly 598 real BTC retained | Not quantified |
| Cryptopolitan | 598 BTC remaining | About $47 million at the time |
The sources do not reconcile these descriptions or magnitudes. Readers should treat the figures as unverified estimates.
“Pay a ransom that far exceeds their economic stake.”
Adam Back, CEO of Blockstream
Withdrawals, Exchanges and Refills: Three Separate Channels
Full backing is a prerequisite, but it does not mean restrictions have been lifted. The October 20 recovery plan lays out a staged sequence:
- Restoration of full 1:1 backing, reached on November 2 or 3 depending on the source.
- Controlled reactivation of direct withdrawals for authorised holders of withdrawal keys.
- Semi-automated BTC-L-BTC swaps with participating providers, with no volume cap imposed by the protocol, while direct withdrawals stay restricted.
- Resumption of normal withdrawal functions and transparent reserve monitoring via block explorers, subject to remaining security requirements.
BTC-L-BTC conversions at 1:1 were restored several weeks before full backing returned. On October 27, the Federation said swaps were available through AQUA, Bull Bitcoin and SideSwap, while normal withdrawals remained subject to “enhanced operational controls”.
On October 20, SideSwap opened its own L-BTC to BTC conversion service at a 1:1 rate minus a standard 0.1% fee. While direct Federation withdrawals stay restricted, every customer payment comes from SideSwap’s own bitcoin wallet, which is refilled manually. Orders can therefore wait when that balance runs low; they are paid in order of arrival after the next refill, with no guaranteed delay. SideSwap said it did not know when Federation withdrawals would resume. Client liquidity and reserve backing are thus two distinct things.
Governance, Technical Defences and Security Lessons
The recovery work spanned several weeks and involved the Liquid Federation, Blockstream and independent security experts. An updated Federation software now manages bitcoin reserves and accounts for the incident’s accounting impact. A sufficient number of Federation officials are using it, which the Federation treats as an operational readiness milestone. Independent safeguards remain active to prevent premature or unauthorised withdrawals.
Adam Back outlined three reinforced lines of defence:
- withdrawal authorisation keys were renewed and moved into offline hardware wallets;
- proof validation caches were disabled and the default was fixed in nodes;
- consensus rules now fail closed when a required condition is not met.
Back added that the network had passed several audits conducted by third parties. The Federation also announced a governance modernisation and clearer allocation of responsibilities, with further details promised in the following weeks.
“Don’t trust, verify.”
Adam Back, CEO of Blockstream
In an interview on October 20, Back described a wave of AI-assisted security analysis, noting that AI can help write secure code but can also be used to find defects. According to Google Threat Intelligence Group, attackers exploited 141 vulnerabilities between January and August 2026, compared with 127 across all of 2025, shortening the gap between disclosure and exploitation. The sources reviewed report no change in BTC, L-BTC or market volume tied to the announcement.
Outlook: Backing Restored, Confidence Still to Rebuild
A return to 100.00% coverage is a measurable milestone, but it does not answer how the shortfall was funded or how the incident figures will be reconciled. Three scenarios stand out. The first is a rapid resumption of direct withdrawals if audits and enhanced controls hold. The second is a prolonged staged recovery, in which provider swaps absorb most exit demand while manual refills keep queues alive. The third is a new incident tied to a consensus or cache flaw, a reminder that the security of a sidechain bridge depends on every software layer.
L-BTC holders would be well advised to follow the Federation’s official updates and the public dashboards before treating the recovery as complete.
Sources
Cet article est publié à titre informatif et éducatif. Il ne constitue en aucun cas un conseil en investissement. Faites vos propres recherches (DYOR) avant toute décision.
