Liquid Federation restores full bitcoin backing for LBTC after September exploit

On November 3, 2026, the Liquid Federation announced the full restoration of 1:1 Bitcoin backing for LBTC tokens, closing a roughly 600 BTC shortfall left by a September 6 software exploit. Blockstream provided the missing funds through staged transfers ending November 2, completing the reserve recovery. Technical fixes included updating the Elements software and moving authorization keys to cold storage, while Blockstream CEO Adam Back cautioned against unverified AI code suggestions.

Restoration of 1:1 Bitcoin reserves

• ▪The Liquid Federation announced on November 3, 2026 that it fully restored 1:1 Bitcoin reserves to back all LBTC tokens following a September 6, 2026 exploit of the Liquid Network
• ▪The Liquid Network public dashboard on November 3, 2026 showed 4,270.54 BTC held in reserve matching 4,270.54 BTC pegged into LBTC

Shortfall funding disclosures

• ▪Liquid Federation board member Samson Mow stated Blockstream supplied 600 BTC for a deficit from the September 6, 2026 Liquid Network exploit, tracking 50 BTC sent October 28, 2026, and 300 BTC and 250 BTC sent November 2, 2026
• ▪The Liquid Federation did not disclose in its official announcement who supplied the bitcoin needed to close the 600 BTC reserve shortfall caused by the September 6, 2026 exploit

Technical cause and execution of exploit

• ▪A September 6, 2026 exploit of the Liquid Network occurred in Elements software because a cache key omitted the asset commitment and scriptPubKey, allowing invalid rangeproof checks to be reused
• ▪An attacker exploited a bug in Blockstream's Elements open-source software to mint approximately 4,000 unbacked LBTC tokens
• ▪An attacker who exploited the Liquid Network on September 6, 2026 routed unbacked LBTC tokens through SideSwap's peg-out service to withdraw actual bitcoin from the Liquid Federation's reserve wallet

Reserve losses and partial return of funds

• ▪An attacker who exploited the Liquid Network on September 6, 2026 returned 3,400 BTC the following day but retained around 598 BTC, demanding a 10% bug bounty that Blockstream refused
• ▪A September 6, 2026 exploit of the Liquid Network reduced the Liquid Federation's Bitcoin reserves from about 4,205 BTC to 197 BTC

Software fixes and security enhancements

• ▪Blockstream CEO Adam Back stated that Liquid Network refreshed peg-out authorization keys, moved them to cold hardware wallets, and completed third-party security audits
• ▪Blockstream released Elements v23.3.4, disabling proof validation caches and hardening consensus rules to fail closed

Risks of AI-generated code vulnerabilities

• ▪Blockstream CEO Adam Back warned developers against trusting AI-suggested code fixes without verification following the September 6, 2026 Liquid Network exploit
• ▪Google Threat Intelligence Group reported 141 exploited flaws between January and August 2026, noting AI tools shorten the timeframe between bug disclosure and exploit creation