The Liquid Network's Bitcoin reserves have been fully restored, reestablishing 1:1 backing for all LBTC, two months after self-described white-hat hackers drained most of them, the Liquid Federation announced on Monday, November 3.

The federation, the group of exchanges and other crypto companies that run the network, said it had reestablished 1:1 Bitcoin backing for all LBTC, the token that represents Bitcoin on the Liquid sidechain. The milestone follows the restoration of swaps between BTC and LBTC at a 1:1 rate through participating providers several weeks earlier.

Update from the Liquid Federation: The Liquid Federation is pleased to announce that the network’s bitcoin reserves have been fully restored, reestablishing 1:1 BTC backing for all LBTC. This follows the restoration of BTC<>LBTC swaps several weeks ago, which have since allowed… — Liquid Network 🌊 (@Liquid_BTC) November 3, 2026 (post on X)

Blockstream CEO Adam Back, whose company develops the technology behind Liquid, posted a screenshot of the network's dashboard showing assets matching liabilities at 100%, with a reserve deficit of 0.00 BTC. Users running their own Liquid nodes can verify the federation's reserves directly, the federation said — meaning the parity claim can be checked independently rather than taken on trust alone. It did not disclose how the shortfall left by the hack was covered.

Launched by Blockstream in 2018, Liquid is a Bitcoin sidechain — a separate blockchain that runs alongside Bitcoin — designed for faster and more private transfers. Users lock up BTC in a wallet controlled by the federation and receive the same amount of LBTC in return; converting LBTC back into Bitcoin is known as a peg-out. That structure makes the federation's reserves the collateral behind the entire system: LBTC redeems at par only if the Bitcoin backing it is actually there, which is why the deficit left by the exploit — and its repair — matter to anyone holding the token.

Asked on X what would stop a repeat of the hack, Back listed three hardened "lines of defense": refreshed peg-out authorization keys now held in cold hardware wallets; disabled proof validation caches, together with a bug fix for nodes; and consensus rules that have been hardened to "fail closed." The network has also been through multiple third-party audits, he said.

"And lesson: treat with suspicion (don't trust, verify) AI suggested fixes," Back wrote.

Back had pointed to AI's growing role in security in an interview with Bloomberg Television on October 20, describing "a wave of AI-assisted security analysis" over the previous couple of months. "AI, of course, is a tool to help develop code and to secure the code, but also it can be used to find defects," he said, adding that it had been "affecting many companies in the sector." He said at the time that the hacked funds remained "under investigation."

The federation said it is modernizing Liquid's governance structure, introducing clearer responsibilities and oversight, and adding further technical and operational safeguards, with more details to come in the coming weeks. How that overhaul takes shape, and whether the roughly 598 BTC the September hackers withheld — funds Back described in October as under investigation — are ever recovered, are the open threads to follow.

The September exploit

On September 6, purported white-hat hackers withdrew about 4,000 BTC, then worth around $320 million, from Liquid's federation wallet, communicating with Blockstream through PGP-signed messages embedded in Bitcoin transactions. The next day, they returned 3,400 BTC, worth about $269 million, after Blockstream said Liquid's bridge nodes had been patched, but kept roughly 598 BTC.

Ledger CTO Charles Guillemet said that if the remaining coins were a negotiated reward, the arrangement looked "more like extortion than white-hat hacking." Blockstream later refused to pay a ransom for the outstanding Bitcoin.

"Taking assets without authorization and withholding their return is a crime, not responsible disclosure," the company said. "It is not white-hat activity. It is theft."