Key facts
- The Liquid Federation said 1:1 Bitcoin backing for all LBTC has been reestablished.
- Adam Back posted a dashboard screenshot showing assets matching liabilities at 100% and a 0.00 BTC reserve deficit.
- The federation did not say how the shortfall left by the hack was covered.
- Back said peg-out authorization keys are now held in cold hardware wallets and consensus rules were hardened to fail closed.
- Blockstream refused to pay a ransom for the outstanding Bitcoin, calling the withholding of assets theft.
The Liquid Federation said on Monday that the Liquid Network's bitcoin reserves have been fully restored, reestablishing 1:1 Bitcoin backing for all LBTC, the token that represents Bitcoin on the sidechain. The announcement came two months after self-described white-hat hackers drained most of the reserves.
The federation said the milestone follows the restoration of swaps between BTC and LBTC at a 1:1 rate through participating providers several weeks earlier. Blockstream CEO Adam Back, whose company develops the technology behind Liquid, posted a screenshot of the network's dashboard showing assets matching liabilities at 100%, with a reserve deficit of 0.00 BTC. Users running their own Liquid nodes can verify the federation's reserves directly, the federation said. It did not say how the shortfall left by the hack was covered.
Launched by Blockstream in 2018, Liquid is a Bitcoin sidechain, a separate blockchain that runs alongside Bitcoin, designed for faster and more private transfers. Users lock up BTC in a wallet controlled by the federation, a group of exchanges and other crypto companies that run the network, and receive the same amount of LBTC in return.
Asked on X what would stop a repeat of the hack, Back listed three hardened lines of defense: refreshed peg-out authorization keys now held in cold hardware wallets, disabled proof validation caches along with a bug fix for nodes, and consensus rules that have been hardened to fail closed. The network has also been through multiple third-party audits, he said. Back wrote: "And lesson: treat with suspicion (don't trust, verify) AI suggested fixes."
Back had pointed to AI's growing role in security in an interview with Bloomberg Television on October 20, describing "a wave of AI-assisted security analysis" over the previous couple of months. He said AI "can be used to find defects" and had been "affecting many companies in the sector." He said then that the hacked funds remained "under investigation."
The federation said it is modernizing Liquid's governance structure, introducing clearer responsibilities and oversight, and adding further technical and operational safeguards, with more details to come in the coming weeks.
On September 6, purported white-hat hackers withdrew about 4,000 BTC, then worth around $320 million, from Liquid's federation wallet, communicating with Blockstream through PGP-signed messages embedded in Bitcoin transactions. The next day, they returned 3,400 BTC, worth about $269 million, after Blockstream said Liquid's bridge nodes had been patched, but kept roughly 598 BTC. Ledger CTO Charles Guillemet said that if the remaining coins were a negotiated reward, the arrangement looked "more like extortion than white-hat hacking." Blockstream later refused to pay a ransom for the outstanding Bitcoin, saying: "Taking assets without authorization and withholding their return is a crime, not responsible disclosure. It is not white-hat activity. It is theft."