Liquid Network Enters Final Recovery Phase After 4,000 BTC Hack

October 21, 2026 MM Crypto Team

The Liquid Network says it is back up and running and entering the final stages of recovery, more than a month after hackers stole 4,000 bitcoin — worth about $320 million at the time — from the network’s federation wallet. That statement describes both a serious security failure and a recovery that has apparently reached its closing phase, and the distinction between those two ideas matters. A network that is back up and running can support activity again, while a network in the final stages of recovery is still completing the work that restores the backing and controls behind that activity. Reading the update carefully therefore means looking at what happened, how the recovery is sequenced, and why its final steps are being handled with particular care rather than rushed through.

Liquid is a Bitcoin sidechain created by Blockstream that allows faster transfers of assets backed 1:1 by bitcoin, including stablecoins and Lightning channels, through apps that support the network. In plain terms, a sidechain is a separate network that runs alongside the main Bitcoin network and is connected to it, so value can move between the two. The appeal is different trade-offs from the main chain, such as faster settlement for certain transfers, while still anchoring value to bitcoin. That anchoring is the heart of the design. When an asset on Liquid is described as backed 1:1 by bitcoin, the expectation is that every unit corresponds to an equivalent amount of bitcoin held in reserve. If that correspondence breaks down, confidence in the whole system is put at risk, which is why restoring full backing is treated as central to recovery rather than as a detail to be tidied up later.

How the Hack Worked

The attackers exploited an inflation bug on the Liquid sidechain to create more than 4,000 LBTC — a token supposedly backed 1:1 by bitcoin — that did not exist before, then cashed them out for real on-chain BTC. An inflation bug, in this context, breaks the rule that new tokens should appear only when an equivalent amount of bitcoin is locked up to support them. The tokens created in this way may look identical to legitimate tokens and move through the same wallets, swaps and applications, but they represent value that was never deposited. That mismatch is the core problem. It is not simply a case of funds being taken from a wallet in the ordinary sense. It is a case of the accounting that underpins the system being undermined, so that unbacked tokens can then be exchanged for real bitcoin on the main chain.

The stolen amount came from the network’s federation wallet. A federation wallet, in this kind of design, is a shared custody arrangement rather than a single wallet controlled by one party. The federation is a group of participants that together help operate the sidechain and secure the bitcoin backing assets on it. That structure is intended to spread trust and responsibility, so no single operator can act alone. At the same time, a shared wallet of this kind becomes a natural focal point when something goes wrong, because it holds the reserves that give the sidechain’s assets their value. When funds leave such a wallet through an exploit, the question is not only how much was taken, but also how the resulting backing shortfall will be addressed and how future movements out of the wallet will be controlled.

Blockstream was able to negotiate the return of most of the funds in what the network described as a white-hat operation. The phrase white-hat is used in security circles to describe activity intended to expose or resolve a weakness rather than to profit from it at others’ expense, and the network’s own description frames the negotiated return in those terms. Negotiation after an exploit is delicate and unusual. It involves communication with the people who carried out the attack, discussion of terms for returning funds, and an effort to bring the situation to a close without further loss. That most of the funds were returned is a significant part of the recovery story, but it also leaves an important nuance in place. Most is not all, and a recovery built around a negotiated return still has to deal with whatever gap remains, as well as with how trust in the system can be rebuilt after the underlying bug has been demonstrated in practice.

The Final Stages of Recovery

In a blog post, Liquid said the final phase of restoration involves reestablishing the network’s full 1:1 bitcoin backing, followed by the controlled reactivation of federation peg-outs for authorized PAK key holders. The order described here is revealing. Restoring full backing comes first, and only then does the controlled reactivation of peg-outs follow. A peg-out is the process of moving value from the sidechain back to the main Bitcoin chain, the reverse of the process by which bitcoin is brought onto the sidechain. If peg-outs were reopened before backing was fully restored, there would be a risk that unbacked value could again be exchanged for real bitcoin, or that legitimate holders could be left uncertain about whether their assets were fully supported. By sequencing the work in this way, the network signals that backing is the precondition for normal movement, not something to be restored alongside it.

The reference to authorized PAK key holders adds another layer of control. Rather than reopening peg-outs to everyone at once, the final phase describes a controlled reactivation limited to authorized holders. That kind of staged reopening is a common approach after a serious incident, because it allows operators to observe how the system behaves under real conditions while limiting exposure. If a problem appears, it can be contained more easily when only a defined group is involved. It also allows checks to be applied to the participants permitted to move funds out, which matters when the very mechanism for moving funds out was at the centre of the exploit. Controlled reactivation is therefore not just a technical step. It is also a governance step, a way of showing that the return to normal service is being managed rather than rushed.

The network said Blockstream, the federation, and independent security experts have made substantial progress, with phased swaps already restored. The mention of three groups is worth noting. Blockstream created Liquid, the federation operates key parts of the network, and independent security experts bring outside scrutiny separate from the organisations with a direct stake in the outcome. Involving independent experts is often seen as important for credible recovery, because it provides a check not limited to the parties who built or run the system. The phrase substantial progress suggests work has advanced beyond early containment into later restoration, and the note that phased swaps have already been restored gives a concrete indication of that progress. Swaps are exchanges between different forms of bitcoin-related value, and their restoration in phases suggests functionality has been brought back step by step rather than all at once.

Swaps Working Again in Full Service

Blockstream CEO Adam Back wrote on X on Tuesday that LBTC-to-BTC swaps were working again in full service, including swaps between Liquid BTC and mainchain BTC as well as Lightning. This statement matters because it describes a return to practical usability, not just a statement of intent. For a user, the question after an incident is often simple: can I move my funds where I need them to go, and will the swap complete as expected? Saying swaps are working again in full service answers that question directly, at least for the swap functions described. Including both mainchain BTC and Lightning is also significant, because it covers two different destinations for value leaving Liquid. Mainchain BTC is bitcoin on the main Bitcoin network itself, while Lightning refers to the layer built for faster payments. Covering both suggests restored service is not limited to a single route.

Risks and Questions That Remain

Even with swaps working again and the final phase under way, several questions naturally remain. One is how the gap left by any funds not returned will be handled as part of restoring full backing, since the report says most funds were returned. Another is what changes have been made to prevent a similar inflation bug from being exploited again. The report does not provide those technical details, and readers should not assume details that have not been stated. A further question is how long the controlled phase for peg-outs will last, and what conditions will need to be met before broader reactivation is considered. These are questions a final recovery announcement will need to answer over time, through actions and further updates rather than through a single statement.

Frequently Asked Questions

What happened to the Liquid Network?

According to the report, hackers stole 4,000 bitcoin, worth about $320 million at the time, from the network’s federation wallet, and the network is now back up and running and entering the final stages of recovery more than a month later.

How did the attackers create unbacked tokens?

The attackers exploited an inflation bug on the Liquid sidechain to create more than 4,000 LBTC that did not exist before, even though LBTC is supposedly backed 1:1 by bitcoin, and then cashed those tokens out for real on-chain BTC.

What does the final phase of recovery involve?

The final phase involves reestablishing the network’s full 1:1 bitcoin backing, followed by the controlled reactivation of federation peg-outs for authorized PAK key holders.

Are swaps working again?

Yes, according to Blockstream CEO Adam Back, who wrote on X on Tuesday that LBTC-to-BTC swaps were working again in full service, including swaps between Liquid BTC and mainchain BTC as well as Lightning, with phased swaps already restored.

What is Liquid?

Liquid is a Bitcoin sidechain created by Blockstream that allows faster transfers of assets backed 1:1 by bitcoin, including stablecoins and Lightning channels, through apps that support the network.

Source: CryptoNews.net

MM Crypto Analysis Web