Liquid restores bitcoin swaps after $320 million hack, but direct peg-outs remain restricted
Liquid has restored provider-based bitcoin swaps after September’s exploit, but its direct withdrawal mechanism remains restricted pending full reserve backing and further safeguards.
The Lead
The Liquid Federation enabled semi-automated swaps between BTC and L-BTC through participating providers on October 20, restoring a practical exit route for token holders more than six weeks after a major exploit disrupted the Bitcoin sidechain.
Key Facts
- The September 6 exploit created about 4,000 unbacked L-BTC and withdrew roughly 4,000 BTC, valued then at about $320 million.
- The actors, who described themselves as white hats, returned 3,400 BTC on September 7.
- Blockstream’s September 23 assessment said approximately 602 BTC remained outstanding.
Article Body
Liquid’s staged recovery update said the provider-based swaps carry no protocol-imposed volume limit, allowing most users of supported services to exchange L-BTC for bitcoin while the Federation’s direct peg-out system stays closed.
The September 6 attack exploited a flaw in the rangeproof-verification cache used by Elements, Liquid’s underlying software. According to Blockstream’s incident assessment, the vulnerability allowed a transaction creating about 4,000 L-BTC without corresponding bitcoin backing to pass validation. The unbacked tokens were then exchanged for real BTC through the standard peg-out process.
Blockstream deployed an emergency patch, released hardened software and restarted transactions in September. The October update says reserve-management software has since been upgraded and independently reviewed, but does not give a date for restoring direct peg-outs. Despite Adam Back’s characterization of operations as returning to normal, that restriction marks an incomplete recovery. The next consequential question is how and when the Federation will close the remaining reserve gap.
What to Watch
The decisive recovery signal will be the reopening of direct Federation peg-outs. Liquid says that step depends on restoring full one-to-one bitcoin backing and completing remaining security and operational requirements.