Business news and discussion on TalkFuse.
Liquid’s bitcoin IOUs are fully backed again after a $320 million exploit
Developed over time first seen 16 hours ago
Liquid Network says its bitcoin reserves once again fully back every LBTC token in circulation, nearly two months after an exploit exposed a large shortfall. On 6 September, a flaw in the Elements software allowed an attacker to create about 4,000 LBTC without depositing the corresponding bitcoin and redeem the tokens for real BTC. The reserve fell from roughly 4,205 BTC to 197 BTC. The attacker returned 3,400 BTC the next day, leaving a gap of about 600 BTC. Deposits in late October and on 2 November closed that gap; SideSwap reported 4,270.54 BTC in reserve against 4,270.54 LBTC in circulation on the morning of 3 November.
The Federation did not identify who supplied the replacement bitcoin in its announcement, although board member Samson Mow said Blockstream provided it. Restored backing does not mean all withdrawal routes are operating normally. Users can exchange BTC and LBTC through participating providers, but SideSwap says the Federation’s own direct withdrawals remain restricted, so its payouts come from a wallet replenished manually and may face delays. The Federation says it will provide details of planned governance, security and operational changes in the coming weeks.
- Sources
- 3
- Outlets
- 3
- Left · Centre · Right
- 0 · 0 · 0
In short
- Liquid says every LBTC is backed by bitcoin again.
- An attacker returned 3,400 BTC; later deposits filled the remaining gap.
- Direct Federation withdrawals remain restricted.
How this story developed
- 4 hours ago Liquid Network says its bitcoin reserves once again fully back every LBTC token in circulation, nearly two months after an exploit exposed a large shortfall.
Full account
The Liquid Federation says its bitcoin reserves have been restored to match the amount of L-BTC in circulation, following a September exploit that allowed an attacker to withdraw bitcoin without providing the corresponding tokens. On the morning of 3 November, it reported 4,270.54 BTC in reserve against 4,270.54 L-BTC in circulation. The Federation describes this as a return to one-to-one backing, which had been in place before the incident.
The exploit took place on 6 September. According to Blockstream’s technical account, a flaw in Elements software’s rangeproof verification cache let a transaction pass validation even though its output was not covered by its inputs. Liquid nodes accepted it, creating about 4,000 unsupported L-BTC. The tokens were then used in peg-outs, converting them into bitcoin. The reserve fell from roughly 4,205 BTC to 197 BTC after the withdrawals, including smaller transactions completed before the network was halted.
The attacker returned 3,400 BTC on 7 September after negotiations, leaving about 602 BTC outstanding, according to the accounts cited by the Federation. Blockstream coordinated a halt to Liquid’s public bridge nodes, applied an emergency patch and later released a reviewed software update, Elements v23.3.4. The Federation says other assets, including USDt and DePix, were not affected, though they could not be used while the network was paused; users’ wallets, keys and balances were not compromised.
The reserve was replenished in several publicly visible Bitcoin transactions: 2.5 BTC on 27 October, 50 BTC on 28 October, then 300 BTC and 250 BTC on 2 November. Peg-in through SideSwap has been available since 11 September, and peg-out since 20 October. The Federation says both operate at a one-to-one rate less a standard 0.1 per cent fee. Its own peg-outs have not resumed; until they do, payouts are made from a separate Bitcoin wallet that the Federation refills manually, so processing may take longer. The Federation says users can check the live reserve and circulation figures, and that Liquid node operators can verify its proof of reserves.
The reports have different scopes and emphases. Blockstream’s account focuses on the technical cause, the attack sequence, network response and corrective work; the Federation’s announcement centres on the restored backing, reserve deposits and current peg services. The Federation gives the precise current reserve and circulation figures and notes the delay in its own peg-outs. The supplied technical account describes the reserve’s fall and recovery of 3,400 BTC, but does not cover the November restoration. Both accounts describe the incident as a software vulnerability that enabled unbacked L-BTC to be withdrawn as bitcoin.
Coverage · 3 sources
Business Crypto Software Technology