In brief

• The Liquid Federation said the sidechain's Bitcoin reserves have been fully restored, reestablishing 1:1 backing for all LBTC after a September exploit.
• Purported white-hat hackers withdrew about 4,000 BTC from the federation wallet in September, returning 3,400 BTC but keeping around 598 BTC.
• Back said key systems have been hardened and audited, and urged developers to treat AI-suggested fixes "with suspicion."

The Liquid Network's Bitcoin reserves have been fully restored, two months after self-described white-hat hackers drained most of them, the Liquid Federation said on Monday.

The federation said it had reestablished 1:1 Bitcoin backing for all LBTC, the token that represents Bitcoin on Liquid. The milestone follows the restoration of swaps between BTC and LBTC at a 1:1 rate through participating providers several weeks ago, it said.

The Liquid Federation is pleased to announce that the network’s bitcoin reserves have been fully restored, reestablishing 1:1 BTC backing for all LBTC.

This follows the restoration of BTC<>LBTC swaps several weeks ago, which have since allowed…

— Liquid Network 🌊 (@Liquid_BTC) November 3, 2026

Blockstream CEO Adam Back, whose company develops the technology behind Liquid, posted a screenshot of the network's dashboard showing assets matching liabilities at 100%, with a reserve deficit of 0.00 BTC. Users running their own Liquid nodes can verify the federation's reserves directly, the federation said.

It did not say how the shortfall left by the hack was covered.

Launched by Blockstream in 2018, Liquid is a Bitcoin sidechain, a separate blockchain that runs alongside Bitcoin, designed for faster and more private transfers. Users lock up BTC in a wallet controlled by the federation, a group of exchanges and other crypto companies that run the network, and receive the same amount of LBTC in return.

Asked on X what would stop a repeat of the hack, Back listed three hardened "lines of defense": refreshed peg-out authorization keys now held in cold hardware wallets, disabled proof validation caches along with a bug fix for nodes, and consensus rules that have been hardened to "fail closed." The network has also been through multiple third-party audits, he said.

"And lesson: treat with suspicion (don't trust, verify) AI suggested fixes," Back wrote.

Back had pointed to AI's growing role in security in an interview with Bloomberg Television on October 20, describing "a wave of AI-assisted security analysis" over the previous couple of months. "AI, of course, is a tool to help develop code and to secure the code, but also it can be used to find defects," he said, adding that it had been "affecting many companies in the sector." He said then that the hacked funds remained "under investigation."

The federation said it is modernizing Liquid's governance structure, introducing clearer responsibilities and oversight, and adding further technical and operational safeguards, with more details to come in the coming weeks.

The September exploit

On September 6, purported white-hat hackers withdrew about 4,000 BTC, then worth around $320 million, from Liquid's federation wallet, communicating with Blockstream through PGP-signed messages embedded in Bitcoin transactions.

The next day, they returned 3,400 BTC, worth about $269 million, after Blockstream said Liquid's bridge nodes had been patched, but kept roughly 598 BTC. Ledger CTO Charles Guillemet said that if the remaining coins were a negotiated reward, the arrangement looked "more like extortion than white-hat hacking."

Blockstream later refused to pay a ransom for the outstanding Bitcoin. "Taking assets without authorization and withholding their return is a crime, not responsible disclosure," the company said. "It is not white-hat activity. It is theft."

Daily Debrief Newsletter

Start every day with the top news stories right now, plus original features, a podcast, videos and more.