Liquid Network restores full bitcoin backing after $320 million exploit

The Liquid Federation announced Tuesday that bitcoin reserves again provide 1:1 backing for all LBTC. The restoration comes nearly two months after an exploit allowed approximately $320 million in bitcoin to be withdrawn from the sidechain. Liquid Federation board member Samson Mow identified Blockstream as the source of the replacement bitcoin.

Mow, a former Blockstream executive, reported that 50 BTC entered the Federation wallet on Oct. 28, reducing the shortfall to 550 BTC. A further 300 BTC arrived on Monday. Another deposit of 250 BTC later on Monday completed the restoration of reserve backing.

Users have been exchanging BTC and LBTC through participating providers for several weeks. Direct Federation peg-outs had been limited while additional security checks were pending. Some semi-automated peg-outs have subsequently restarted. The Federation did not disclose on Tuesday whether the remaining restrictions had ended. Reserve balances are publicly available on the Liquid website, and Liquid node operators can independently check the backing.

The Sept. 6 exploit removed about 4,000 BTC from Liquid's Federation wallet. The attacker returned roughly 3,400 BTC the following day after Blockstream patched the affected bridge nodes. The attacker retained about 600 BTC. Blockstream, led by Adam Back, develops the technology underlying Liquid Network. Blockstream subsequently refused the attacker's demand for a 10% bug bounty to return the remaining bitcoin. Blockstream said paying the demand would establish a precedent requiring developers of open-source Bitcoin software to pay ransom far beyond the developers' economic participation.

Liquid's September incident report attributed the exploit to a flaw in cached range proof verifications within Elements, the software underlying Liquid Network. The incident report said the flaw allowed the attacker to generate approximately 4,000 LBTC without bitcoin backing. The attacker used those LBTC to withdraw bitcoin through SideSwap, a Liquid Network wallet and trading platform. SideSwap is a Federation member that holds a peg-out authorization key. Liquid said network operators had not been hacked and no keys had been compromised.

Elements v23.3.4 was issued on Sept. 9 to fix the vulnerability. Liquid restarted block production later on Sept. 9. User transactions resumed on Sept. 10, but Federation peg-outs were still disabled at that point.

The Federation said the latest recovery work included restoring reserves and strengthening the network's underlying infrastructure. The Federation thanked the Bitcoin community, Liquid users and ecosystem partners for continued participation and patience during the recovery. The Federation said changes to governance and oversight, alongside further technical and operational safeguards, were being prepared. The Federation expects to provide more information in the coming weeks.