Liquid Restores Full Bitcoin Backing After $319M Hack

Liquid’s Bitcoin reserve closes the gap

SideSwap’s November 3 update reported 4,270.54 BTC in the Federation reserve against 4,270.54 LBTC circulating that morning, citing the public network dashboard. The provider said the Federation had confirmed that every LBTC was again fully backed.

The replenishment included 2.5 BTC on October 27, 50 BTC on October 28, and deposits of 300 BTC and 250 BTC on November 2. SideSwap links the last two transfers to public Bitcoin transaction records, including the final 250 BTC deposit.

Those deposits total 602.5 BTC. They describe replacement reserves, not evidence that the attacker returned the remaining stolen coins. A funding transfer into a reserve and recovery from an attacker have different implications for who ultimately bears an incident’s cost.

Unchained reported November 3 that Federation board member Samson Mow credited Blockstream with providing the funds. The Federation’s own announcement did not identify the source, according to the report.

The development follows the site’s September coverage of Blockstream’s ransom refusal, when backing remained incomplete and Bitcoin redemptions were blocked. The new event is the completed replenishment, rather than a routine change in circulating supply.

September exploit withdrew about 4,000 BTC

TRM Labs’ September 8 analysis valued the original theft at about $319 million and the returned funds at roughly $272 million, or about 85% of the total. Those historical estimates should not be added to November reserve values or treated as new losses.

Blockstream’s September 23 assessment says a flaw in Elements transaction verification let an attacker create approximately 4,000 unbacked LBTC and redeem them for actual Bitcoin. Its account identifies the withdrawal in Bitcoin block 965,783 and the return of 3,400 BTC on September 7 in block 965,950.

The report put the amount still outstanding at approximately 602 BTC. Earlier reporting used about 598.5 BTC; the later assessment is the figure used here for the historical reserve recovery account. The reviewed sources do not provide a reconciled, unique customer-victim count.

The reserve’s fall from about 4,205 BTC to 197 BTC also included smaller peg-outs before the halt, Blockstream said. It would therefore be misleading to label every Bitcoin leaving the reserve during that interval as attacker proceeds.

As checked November 4, the restoration notices establish replacement backing, without establishing that all stolen funds were returned. They do not describe a new attack wave. Blockstream’s report says other Liquid-issued assets were unaffected by the exploit, although unavailable during the pause.

SideSwap conversions differ from Federation peg-outs

The Federation’s October 20 recovery plan placed provider swaps before controlled reactivation of direct peg-outs for authorized key holders. Restoring reserves was one requirement within that sequence, alongside security and operational checks.

SideSwap’s reopening notice says its LBTC-to-BTC service resumed October 20 at one-to-one less a 0.1% fee. Payouts come from SideSwap’s Bitcoin wallet while received LBTC is exchanged in bulk behind the service.

Its November 3 update says that wallet is refilled manually and orders can queue until a refill arrives. It continues to describe the Federation’s own peg-outs as restricted. A fully backed asset therefore does not automatically offer immediate settlement through every redemption route.

The distinction also runs through the site’s coverage of native Bitcoin collateral and WBTC liquidation routes: backing, custody and conversion mechanics each determine a different part of a user’s exposure.

Alternative.me’s Bitcoin Fear and Greed Index read 34, or Fear, on November 4, compared with 26 a day earlier. It measures wider market sentiment rather than confidence in Liquid’s reserve or demand for LBTC.

As of 09:01 UTC on November 4, the reviewed notices did not establish a date for unrestricted Federation peg-outs. The next concrete milestones are a confirmed operational reopening and the governance and safeguard details the Federation has promised in the coming weeks.