The Liquid Federation says LBTC is once again backed one-for-one by Bitcoin, after a September exploit drained most of the network’s reserves. But restored reserves have not brought back direct withdrawals. Users have been able to swap through a provider, while direct Federation peg-outs remained restricted in recovery updates reported through November 3.
- About 4, 000 LBTC were created without matching Bitcoin deposits.
- The attacker returned 3, 400 BTC, followed by deposits totaling 602.5 BTC.
- SideSwap resumed swaps, but direct Federation peg-outs remained restricted.
- Questions about replacement funds and custody controls remain open.
How the September exploit drained Liquid’s reserves
The exploit happened on September 6 and involved Elements, the open-source software used by Liquid. KuCoin reported that roughly 4, 000 LBTC were created without matching BTC deposits, then converted into Bitcoin through SideSwap, a Federation member authorized to process withdrawals.
Liquid is a federated Bitcoin sidechain. Bitcoin deposited on the main network is represented on Liquid as LBTC, with BTC held in reserve under Federation arrangements. Members handle conversions back to Bitcoin, known as peg-outs. The Federation oversees Liquid’s operations and reserves. It is not a single company or a permissionless redemption service.
According to Blockstream’s security assessment, the incident involved two Elements consensus-validation bugs and a separate gap in one member’s peg-out authorization process. Put simply, a flaw in a software cache could let a node reuse an earlier rangeproof check when it should have checked again. Rangeproofs help verify that confidential transaction amounts are valid without revealing them. The check also relies on details that identify the asset and transaction output.
Blockstream said the flaw could cause nodes with different cache contents to reach different conclusions about whether a transaction was valid. That creates a consensus risk: network participants might disagree about which transactions to accept. The assessment describes a potential disagreement, but the available information does not show that nodes actually split into competing versions of the network.
The separate peg-out authorization gap involved withdrawal controls, not just transaction validation. Public reporting does not fully establish how the software bugs and authorization weakness connected to the attacker’s actions. The incident is best understood as a combination of technical and operational failures, rather than a single exploit sequence documented in full.
KuCoin reported that reserves fell from approximately 4, 205 BTC to 197 BTC after the unauthorized activity and other withdrawals completed before operations stopped. On September 7, the attacker returned 3, 400 BTC after communicating with Blockstream through messages recorded on Bitcoin. The attacker claimed to be a white-hat security researcher, but their identity and motives have not been independently established.
How the reported shortfall was covered
Blockstream’s September assessment put the remaining shortfall at roughly 602 BTC. KuCoin later reported four deposits: 2.5 BTC on October 27, 50 BTC the next day, and 300 BTC plus 250 BTC on November 2. Together, the deposits total 602.5 BTC.
The reported figures leave a small, unexplained difference. The approximate decline from 4, 205 BTC to 197 BTC is about 4, 008 BTC. Subtracting the 3, 400 BTC return suggests a gap of roughly 608 BTC, not 602 BTC. The figures are approximate and reflect different snapshots, but the available information does not fully reconcile them. They should not be read as one exact accounting statement.
The Federation said reserves were “fully restored, reestablishing 1:1 BTC backing for all LBTC.” KuCoin reported that approximately 4, 268.95 BTC backed an equivalent amount of LBTC when the shortfall was closed. By November 3, the reported balance had reached 4, 270.54 BTC, reflecting later activity. These are on-chain balances reported at different times, not an independent audit of ownership or custody.
Samson Mow, a member of the Liquid Federation’s board, identified Blockstream as the source of replacement funds in a response on X, as reported by KuCoin. The Federation has not published a detailed breakdown of contributions. Reserve balances show how much BTC was present at the reported times. They do not establish who owns or controls the wallets that supplied it, or whether the funds are subject to other claims.
Swaps resumed; direct peg-outs did not
SideSwap reopened BTC/LBTC swaps on October 20. KuCoin reported that customers could exchange LBTC for BTC at a 1:1 rate, less a 0.1% fee. SideSwap said its reserves matched the circulating LBTC supply, but that claim came from the provider, not an independent audit.
A provider-run swap differs from a direct Federation peg-out. With a swap, a service facilitates the exchange under its own operating arrangements. A direct peg-out uses the Federation’s withdrawal process to release BTC against LBTC. The staged recovery allowed provider swaps to resume while direct peg-outs remained restricted. The reported updates gave no date for reopening direct withdrawals.
The distinction matters. Reserves can match token supply even while operators limit withdrawals to review software and authorization controls. “Fully backed” describes the reported relationship between reserves and supply. It does not mean every withdrawal route is open or every security concern has been resolved.
What still needs to be demonstrated
Blockstream’s assessment points to two separate tasks: fixing transaction-validation defects and strengthening withdrawal authorization. A software fix would not address weak operational controls. Tighter procedures would not repair a consensus bug.
The Federation has said it plans further governance and security measures, including changes to withdrawal authorization involving offline Bitcoin keys. The details matter. Users need to know who can authorize a peg-out, what checks apply, and how the system limits damage if a safeguard fails.
Liquid’s reported return to 1:1 backing marks a meaningful step in the recovery. The next test is whether the Federation can explain its funding and custody arrangements clearly, demonstrate stronger controls, and say when direct withdrawals can safely resume. A matching on-chain balance is useful evidence of reserves, but it cannot replace transparency about who controls them.
Key questions about Liquid and LBTC
-
Is LBTC fully backed again?
The Federation says reserves again provide 1:1 BTC backing, and reported on-chain balances support that claim at the stated times. Those balances do not independently verify wallet ownership, control, or custody arrangements.
-
How was the shortfall covered?
The attacker returned 3, 400 BTC, followed by reported deposits totaling 602.5 BTC. Mow identified Blockstream as the source of replacement funds, but no detailed funding breakdown has been published.
-
Can users convert LBTC to BTC?
SideSwap resumed swaps on October 20 at a 1:1 rate, less a 0.1% fee. Direct Federation peg-outs remained restricted in recovery updates reported through November 3.
-
Were the attackers confirmed to be white-hat researchers?
No. The attacker claimed to be a white-hat researcher, but their identity and motives have not been independently established.
-
When will direct Federation withdrawals reopen?
The reported updates gave no confirmed date. The Federation has said it plans further security and governance measures, but the specific changes and timeline remain unclear.
