Liquid Restores 1:1 Bitcoin Backing for LBTC After September Security Breach

The Liquid Network has completed the restoration of its Bitcoin reserves following a September exploit, with a final transfer of 250 BTC bringing its LBTC tokens back to full one-to-one collateralization. The federation behind the network has confirmed the recovery but has not revealed who provided the Bitcoin needed to cover the outstanding deficit.

The reserve shortfall emerged after a software vulnerability allowed an attacker to create approximately 4,000 LBTC without depositing the corresponding Bitcoin. The tokens were then redeemed for actual BTC, draining most of Liquid’s reserves.

Liquid is a Bitcoin sidechain managed by a federation of companies led by Blockstream. It is used by exchanges and traders seeking faster Bitcoin transfers than those available through the main blockchain.

Under its operating model, users deposit real Bitcoin with the federation and receive LBTC tokens in return. Each token is intended to represent one BTC and can be redeemed at a one-to-one rate.

The system suffered a major disruption on September 6, when the vulnerability enabled the unauthorized creation of unbacked LBTC. According to Blockstream’s incident report, the network’s Bitcoin reserves dropped from roughly 4,205 BTC to only 197 BTC.

The attacker, who claimed to be a white-hat hacker, returned 3,400 BTC the following day. However, approximately 600 BTC remained missing, leaving the network without enough reserves to fully support its outstanding LBTC supply.

The remaining gap has now been closed. In a Monday announcement on X, the Liquid Federation said its reserves had been replenished and that every LBTC was once again backed by an equivalent amount of Bitcoin. The final 250 BTC transfer completed the restoration.

The federation said the reserve balance is available for public verification through Liquid’s online dashboard.

Still, the operators have not explained where the Bitcoin used to cover the remaining deficit originated. The missing 600 BTC was worth more than $40 million, making the undisclosed funding source a key unanswered question following the recovery.

Trading between BTC and LBTC at a one-to-one rate has been available through providers such as SideSwap since late October. However, direct withdrawals through the federation continue under additional safeguards described as “enhanced operational controls.”

The federation has also promised to share further information about governance changes in the coming weeks.