The Liquid Network says it's in the final stages of restoring full 1:1 bitcoin backing after hackers drained about 4,000 bitcoin — roughly $320 million at the time — from its federation wallet in September. Blockstream CEO Adam Back confirmed on X that swaps are working again as part of a phased reintroduction. Most of the stolen funds have been returned, but the hackers are still holding around 600 BTC, close to $50 million at current prices.
How the attack actually worked
The exploit wasn't a brute-force break of the federation wallet's keys. According to the recovery update, the attackers abused an inflation bug on the Liquid sidechain to mint more than 4,000 LBTC tokens that never existed before, then cashed them out for real on-chain BTC. That's a supply-integrity failure rather than a custody failure, which is why the fix involves re-establishing the network's full 1:1 bitcoin backing before peg-outs are reactivated.
The final phase of restoration is being handled in controlled steps: Federation peg-outs will only resume for authorized PAK key holders once the backing is verified. Blockstream says its team, the Federation, and independent security experts have made substantial progress, with the necessary technical infrastructure and safeguards now in place.
The 'white hat' label doesn't quite fit
The hackers claimed they were white hats and communicated with Blockstream through messages written into Bitcoin blocks. They demanded a 10% bounty and threatened to publish all of Blockstream's encrypted messages if they weren't paid. Critics have pushed back hard on the white-hat framing because the attackers kept 15% of the stolen funds — millions of dollars' worth — rather than returning everything.
That 15% is the remaining 600 BTC the hackers still control. Whether Blockstream reached a private settlement with them is not clear. The company hasn't said publicly, and the recovery update doesn't address it.
What users can expect now
Swaps are back, but the peg-out process is being reintroduced in phases rather than all at once. Liquid is a layer-2 built by Blockstream that lets users move assets backed 1:1 with bitcoin, so the integrity of that backing is the whole ballgame. The controlled reactivation for PAK key holders is the practical bottleneck: until those peg-outs are fully open, not every user will be able to move funds off the sidechain on demand.
The timing isn't great for Liquid, which has spent years positioning itself as a settlement layer for exchanges and institutions that want faster bitcoin movement without giving up custody guarantees. An inflation bug that let someone mint tokens out of thin air is the kind of failure that gets remembered longer than a routine outage.
The open question
The next concrete milestone is the full restoration of 1:1 backing and the complete reopening of Federation peg-outs — Blockstream hasn't given a firm date for either. The unresolved piece is the 600 BTC still sitting with the attackers and whether any negotiated arrangement exists behind the scenes. Until Blockstream says otherwise, that's the part of this story nobody outside the company can confirm.
