Skip to the article
Crypto Daybook

Markets, chains and policy news

Liquid Network restores bitcoin backing after $320 million exploit

The Liquid Federation says every LBTC is backed one-for-one again after Blockstream supplied bitcoin left missing by a September exploit, though peg-out limits may remain.

Crypto Daybook Newsroom2 min read

Liquid Network restores bitcoin backing after $320 million exploit

The Liquid Federation says its bitcoin reserves are fully restored, returning every LBTC to one-for-one backing after a September exploit removed about 4,000 bitcoin worth roughly $320 million. The Federation said in its announcement that users can verify the reserves through its public dashboard or by running a Liquid node.

Liquid is a Bitcoin sidechain, a separate network linked to Bitcoin. LBTC is its bitcoin-linked token. The restored backing closes the reserve gap, but does not by itself confirm that all withdrawal services have returned to normal.

How did the Federation replace the missing bitcoin?

Blockstream supplied the bitcoin used to restore the reserves, according to Liquid Federation board member Samson Mow, as reported by The Block. Mow said 50 BTC arrived on Oct. 28, leaving 550 BTC outstanding. A further 300 BTC and 250 BTC arrived on Monday, Nov. 2, completing the restoration.

The Federation said BTC-to-LBTC swaps had already resumed several weeks earlier through participating providers. Its announcement did not say whether restrictions on direct Federation peg-outs, which convert LBTC back into bitcoin, had been lifted. The Block reported that some semi-automated peg-outs had resumed, while direct peg-outs remained subject to additional checks.

How did the September exploit drain the reserves?

Liquid’s incident assessment says a flaw in Elements, the software behind the network, let a transaction pass verification without being backed by its inputs. The attacker created about 4,000 unbacked LBTC and used SideSwap, a Federation member, to convert them through the standard peg-out process. About 4,000 BTC left the Federation wallet, reducing its reserves from roughly 4,205 BTC to 197 BTC.

The attacker returned 3,400 BTC on Sept. 7, according to the assessment. Blockstream released Elements v23.3.4 to fix the vulnerability. The assessment says the flaw involved the software’s range-proof verification cache, which helps nodes check confidential transaction amounts without revealing them.

What changes does the Federation plan next?

The Federation says it is working on changes to governance and oversight, along with more technical and operational safeguards. It plans to share details in the coming weeks. Full backing is restored, but the Federation says its security and resilience work is still under way.

References