On 2 November 2026, nearly two months after an exploit drained its entire reserve, the Liquid Federation announced that Liquid’s bitcoin reserves were “fully restored, reestablishing 1:1 BTC backing for all LBTC.” Every L-BTC in circulation once again has a real bitcoin behind it.
That is good news for L-BTC holders who thought they might have to accept a 15% haircut or have their funds stuck in the network for much longer until the reserve level reached 100%
In the grand scheme of things, waiting 2 months to cover and close the financial hole is a far better deal than most victims of hackers will get.
While most will stop there and look to peg out into the main chain because they have no faith in Liquid as a custody method, some are asking: where did the funds come from if the hacker didn’t return all of them?
A few other questions linger, such as whether the attacker will return the remaining coins, or whether people will trust a federated sidechain with their bitcoin again.
How the Gap Was Closed
A quick recap.
On 6 September, an attacker exploited a bug in a range-proof verification cache in Elements, the software Liquid runs on. They created roughly 4,000 unbacked L-BTC and redeemed them for real bitcoin through SideSwap, a federation member holding a peg-out authorisation key. Liquid said no keys were compromised and no network operators were hacked.
Reserves fell from about 4,205 BTC to 197 BTC.
The attacker returned 3,400 BTC the next day, after Blockstream patched the affected bridge nodes, and kept about 598.5 BTC. Blockstream’s own assessment put the unrecovered amount at about 602 BTC.
That gap was filled in four deposits between 27 October and 2 November, totalling about 602.5 BTC:
- A small deposit of about 2.5 BTC and then 50 BTC on 28 October, which left 550 BTC outstanding
- 300 BTC on 1 or 2 November
- A final 250 BTC later that day
Reporting varies slightly on the dates. Blockchain records showed roughly 4,269 to 4,271 BTC in reserve against the same amount of L-BTC in circulation once it was done.
Where Did the Bitcoin Come From?
The reports agree on one thing: Liquid Federation board member and former Blockstream executive Samson Mow said Blockstream supplied it. When asked on X where the coins were coming from, he answered: “As stated many times, Blockstream.” Blockstream CEO Adam Back had publicly pledged on 10 September that the peg would be covered one to one.
The sources do not provide any details.
CoinDesk noted that the federation itself had not said who paid.
SideSwap’s statement thanked Blockstream and federation members but declined to identify the source independently. So the attribution rests on Mow’s posts rather than an official federation disclosure.
Beyond that, anything about the source is speculation. Plausible possibilities include:
- Blockstream’s corporate treasury or balance sheet. The simplest explanation, and consistent with what Mow said.
- Coins held by Blockstream’s leadership or affiliated entities. Back pledged coverage publicly, so personal or affiliated holdings are conceivable. Nothing I found confirms it.
- Contributions from other federation members. The federation has 15 members, and a shared loss would be a natural way to split the cost, though the reports describe Blockstream as the source.
- Insurance or other recoveries. Possible in principle, but I found no sign of either.
- VC Funding: Blockstream could have conducted a private deal with venture capital funds to raise the Bitcoin required to get the liquid network up and running.
The staged deposits, in tranches of different sizes over about a week, might suggest the coins were being assembled rather than moved from one pile.
But that is only a guess.
The real answer is on-chain: anyone can examine the deposit addresses and their history. If Blockstream or the federation wants to settle the question, publishing the details would do it.
And yet they choose not to, which does leave users slightly uneasy about who funded their “bailout”!
You Can Audit It Yourself
What distinguishes this from a custodial failure is that the claim is checkable. The federation says users running their own Liquid node can verify its Proof of Reserves directly, and that balances can be followed on the public dashboard at liquid.network, which shows reserves and L-BTC in circulation side by side.
That matters for two reasons. First, “trust us” is not the only option. You don’t have to take the federation’s word that the gap is closed, and the reports I found cite explorer data matching reserves to supply. Second, the same check is how the problem was visible in the first place: during the incident, reserves of about 197 BTC sat against thousands of L-BTC in circulation.
There is a limit, though.
An audit tells you whether the reserve matches the supply right now. It would not have prevented the exploit, and it can’t tell you whether the next bug exists. It detects a problem after the fact, which is useful, but not the same as safety.
Peg-Ins, Peg-Outs and What Is Actually Running
The picture on redemptions is mixed, and it’s easy to overstate.
- Swaps are working. BTC and L-BTC swaps through participating providers resumed several weeks ago at a 1:1 rate, and SideSwap re-enabled its peg-out function on 20 October. The federation said this restores a practical way for most users accessing Liquid through those providers to convert L-BTC to BTC.
- Direct federation peg-outs are still restricted. They remain subject to additional security and operational requirements, with no confirmed reopening date, although reports say some semi-automated peg-outs have resumed.
- Fixes are underway. An independent external audit of the patched Elements v23.3.4 has started, the peg-out authorisation key list is being replaced with keys stored in cold storage, and vulnerable verification caches have been disabled.
In other words, the reserve is whole, but the normal exit door is not fully open. For users who rely on a provider to swap, the practical difference is small. For anyone who wants the federation’s own peg-out, it is not yet available.
Will This Change How People Use Liquid?
Almost certainly, and unevenly.
What helps. The loss was covered in full, and the reserve is verifiable on-chain. Blockstream refused to hand over a bounty, which signals that it will absorb losses rather than pass them to users. The federation has also promised changes to governance and oversight, clearer responsibilities and further technical safeguards, with details due “in the coming weeks.”
What hurts. A “fully backed” token is not the same as a trusted one. For roughly two months, L-BTC holders could not freely redeem, and some wallet and exchange customers, such as those of Bull Bitcoin, couldn’t convert L-BTC back to BTC through their platforms. Commentators criticised how the crisis was handled. One analysis put it bluntly: the backing has been restored, but trust in how the reserve is managed has not fully returned.
The deeper issue is structural. Liquid’s pitch is that 11 of 15 well-known institutions jointly hold the bitcoin, which trades some of Bitcoin’s trust-minimisation for speed and privacy. This incident showed a different kind of risk.
No signer was bribed, and no key was leaked.
A flaw in shared software made the multisig sign something it should never have signed. Every holder was exposed through no action of their own, and the recovery depended on one company choosing to fund it.
My expectation is that the effects will vary by who is using it:
- Traders and settlement users moving funds for short periods may return quickly, since swaps work and the reserve is verifiable.
- Larger holders and treasuries will probably want to see the governance changes, the audit results and direct peg-outs reopened before holding meaningful balances for long.
- Exchanges and wallets that list L-BTC will weigh redemption reliability heavily, since they were the ones telling customers they couldn’t convert.
Back’s own comment on the incident was to be sceptical of AI-recommended fixes and verify rather than trust. The sources I saw don’t explain the context, so I wouldn’t read more into it than that.
What About the Attacker’s Coins?
About 598.5 BTC remains in an address under the attacker’s control. I found no reports that these coins have moved, but I haven’t verified the address on-chain myself, so check a block explorer before treating that as current.
The history is worth reviewing.
The attacker posted on-chain messages calling themselves white hats, returned 3,400 BTC, and then demanded a 10% bounty, paid by Blockstream, while warning that L-BTC holders could face a 15% loss if it refused.
Blockstream refused on 11 September, saying it “will not pay a ransom for the return of stolen funds,” and arguing that paying would set a precedent forcing open-source Bitcoin developers to pay ransoms far beyond their own economic participation.
Blockstream’s stated options since then are limited:
- Voluntary return. It has urged the holders to return the remaining coins without conditions.
- Tracing. The coins sit on a transparent chain, so any movement can be watched, and Blockstream has said law enforcement and exchanges could join the hunt.
- Legal action. Some reports say Blockstream plans legal recovery efforts, though I found no confirmation of a filing.
The attacker’s threat of a 15% loss to holders never materialised, because Blockstream covered the gap itself. That removes the attacker’s main leverage, and it means the remaining coins are now simply a theft Blockstream has already absorbed.
Moving or cashing out 598.5 BTC without being traced is difficult, which is probably the best reason to think they may eventually be returned or seized, but there is no sign of either yet.
Peg in/out Activity since the backing
Since the backing was restored, we’ve seen signs of life on-chain with 25 peg-ins (13 deposits) and peg-outs (12 withdrawals) in total.
| Date | Amount |
| ‎2026-11-06 19:32 | ‎+1.28131034 BTC |
| (19 hours ago) | |
| ‎2026-11-06 17:16 | ‎+1.04358661 BTC |
| (21 hours ago) | |
| ‎2026-11-06 16:05 | ‎-2.57771129 BTC |
| (22 hours ago) | |
| ‎2026-11-06 08:13 | ‎+2.19262279 BTC |
| (1 day ago) | |
| ‎2026-11-06 05:50 | ‎-3.06974427 BTC |
| (1 day ago) | |
| ‎2026-11-05 21:26 | ‎+2.53153652 BTC |
| (2 days ago) | |
| ‎2026-11-05 19:54 | ‎-2.50318429 BTC |
| (2 days ago) | |
| ‎2026-11-05 17:37 | ‎-0.00007683 BTC |
| (2 days ago) | |
| ‎2026-11-05 12:58 | ‎-6.02845060 BTC |
| (2 days ago) | |
| ‎2026-11-05 11:00 | ‎+1.04678273 BTC |
| (2 days ago) | |
| ‎2026-11-05 06:54 | ‎+1.21454527 BTC |
| (2 days ago) | |
| ‎2026-11-05 05:33 | ‎+1.01746150 BTC |
| (2 days ago) | |
| ‎2026-11-04 22:15 | ‎-5.00000000 BTC |
| (3 days ago) | |
| ‎2026-11-04 22:00 | ‎-0.00100000 BTC |
| (3 days ago) | |
| ‎2026-11-04 14:19 | ‎+1.72728120 BTC |
| (3 days ago) | |
| ‎2026-11-04 10:01 | ‎+1.51260325 BTC |
| (3 days ago) | |
| ‎2026-11-04 07:42 | ‎+1.00323700 BTC |
| (3 days ago) | |
| ‎2026-11-04 02:57 | ‎-0.01432468 BTC |
| (3 days ago) | |
| ‎2026-11-04 02:27 | ‎-0.15000000 BTC |
| (4 days ago) | |
| ‎2026-11-04 01:51 | ‎-0.10000000 BTC |
| (4 days ago) | |
| ‎2026-11-04 01:12 | ‎-0.01000000 BTC |
| (4 days ago) | |
| ‎2026-11-04 00:43 | ‎-0.00100000 BTC |
| (4 days ago) | |
| ‎2026-11-03 19:04 | ‎+1.36682576 BTC |
| (4 days ago) | |
| ‎2026-11-03 16:55 | ‎+1.07062198 BTC |
| (4 days ago) | |
| ‎2026-11-03 07:15 | ‎+1.58949717 BTC |
| (4 days ago) |
Mind The Gap
Liquid has done the thing it most needed to do: every L-BTC is backed again, and anyone can check. The harder work is still ahead, like driving up activity and generating more revenue for the chain so that reliance on those external funds can be reduced.
Then the audit and governance changes need to include real detail, and the funding source deserves a clear explanation.
Whether people return to Liquid will depend less on the balance sheet than on whether the federation can show that the next software bug won’t put the whole reserve at risk.
