Fast Update

Liquid restores LBTC backing 1:1 after $320m exploit

2026-11-04 · 3 min read
Bitcoin (BTC/USDT) price chart on a trading screen
Image source: SOS Gospodarka

On Monday, November 3, the Liquid Federation said its bitcoin reserves are fully restored. Every LBTC is backed by one bitcoin again. The announcement closes a hole that opened on September 6, when a software flaw let an attacker mint about 4,000 LBTC with nothing behind them and redeem them for real bitcoin.

The damage was stark. Blockstream's incident report put the reserve at about 4,205 BTC before the exploit and 197 BTC after it. The attacker returned 3,400 BTC the next day but kept about 598 BTC. That gap is what closed now: four deposits totalling about 602.5 BTC, the last of them 250 BTC on November 2. Explorer data cited by Bitcoin.com puts 4,270.54 LBTC in circulation, backed by the same amount of bitcoin.

What the federation did not explain

The federation did not say where the last roughly 600 BTC came from. Federation board member Samson Mow pointed to Blockstream as the source of the replacement funds, in remarks reported by several outlets. That is Mow's account, not the federation's statement. And one distinction matters: full backing is not the same as recovered funds. Replacement deposits closed the gap; the roughly 598 BTC kept by the attacker has not come back. Blockstream refused to pay a ransom for the remainder, calling the withholding theft rather than white-hat work.

What is back to normal, and what is not

Swaps between BTC and LBTC through providers such as SideSwap returned to 1:1 several weeks ago. Direct withdrawals through the federation remain under tighter operational controls. Blockstream CEO Adam Back published a screenshot of the network dashboard showing assets matching liabilities, with a reserve deficit of 0.00 BTC, and the federation says anyone running a Liquid node can check the reserves directly.

Back also named three hardened lines of defence: refreshed peg-out authorisation keys now held in cold hardware wallets, proof validation caches switched off alongside a bug fix, and consensus rules hardened to fail closed. The network has been through several third-party audits, he said, and the federation promised governance details in the coming weeks. His advice to developers is worth repeating in plain terms: do not trust a machine-suggested code fix without checking it yourself. That is advice, not proof the hole can never reopen. The old-version hot wallet warning is in our BTCPay article. A very different emergency recovery, by Arbitrum's council, is in our Arbitrum article.

Sources: CoinDesk (Nov 3, 2026), Decrypt (Nov 3, 2026), Bitcoin.com (Nov 3, 2026). Figures and status are snapshots at writing time, early November 4, 2026 WIB, and can change.

Logo Mastechon
Written by Mastechon

Writing about crypto and Super Intelligence: market news, new projects, Super Intelligence models, and early opportunities like airdrops and testnets. Every piece starts from the official announcement, with the costs worked out up front.

← All articles

Related guides

Fast Update

Arbitrum moved $30m of Binance hack funds without the key

Arbitrum's Security Council moved 8,425 ETH and 74 million ARB from a Binance hack address without the attacker's key, by briefly swapping the Inbox code.

Fast Update

Baidu launches Apollo World to simulate robotaxi roads

Baidu launched Apollo World, a world model generating up to 100,000 km a day to train Apollo Go robotaxis, built on 350 million km of real road data.

Fast Update

BTCPay Server hot wallets drained on old versions

BTCPay Server traced hot wallet thefts to instances running version 2.4.1 or older, and urges operators to update to 2.4.7 and move to a fresh server.

Fast Update

Binance emergency fund halved to 7,500 BTC

Binance's SAFU wallet now holds 7,500 BTC, about $580 million, after four October 31 transactions halved its balance. A refill is pledged, with no date.

Fast Update

ZachXBT flags $106 million suspected stolen from EU entity

ZachXBT flagged a suspected $106 million theft from an EU entity's accounts at exchanges. The funds left as stablecoins, then were swapped into ETH and Monero.

Fast Update

Chainalysis puts Mercado Bitcoin loss at $49 million

Chainalysis estimates $49 million stolen from Mercado Bitcoin across 17 chains, with nearly $10 million frozen. The exchange itself puts $38 million involved.

Fast Update

Claude's invisible watermark reaches 4 older models Nov 3

From November 3, Anthropic adds an invisible watermark to 4 older Claude models. It changes nothing you read, but two models carry it only at default settings.

Fast Update

Binance finishes zk proof: 10 tokens verifiable 1:1

Binance finished the zero-knowledge proof for its October 31 snapshot: 10 tokens are now user-verifiable at 1:1. What changed, and what it does not cover.

Fast Update

Mercado Bitcoin halts withdrawals after security incident

Brazil's exchange halted withdrawals after a November 2 security incident. Researchers flagged over $40M in suspicious transfers, unconfirmed by the exchange.

Fast Update

Binance outflows hit $4.7 billion, but the pace is slowing

Binance customers pulled a net $4.72 billion since withdrawals reopened, about 2.8% of assets. Volumes have slowed and $2.7 billion flowed back in.

Fast Update

Best model scores just 12% on SemiAnalysis GDPx test

SemiAnalysis released GDPx November 2: 206 tasks across 11 fields, best model Claude Opus 5.5 at 12.0%. It measures distance to real expert work.

Fast Update

Meituan releases LongCat-2.5 for long coding jobs

Meituan released LongCat-2.5 on November 2: a multimodal model for long coding work, scoring 88.4 on Terminal Bench. Its parameter count is still disputed.

Fast Update

US Bitcoin ETFs lose $643 million in a day, most since June

US spot Bitcoin ETFs lost $643.3 million net on Friday, October 30, their largest since June 25. Ether funds lost $155.9 million, yet Bitcoin rose to $78,491.

Fast Update

Apple Intelligence arrives in China, powered by Qwen

Apple and Alibaba announced October 31: Qwen will power Apple Intelligence in China. Developer beta starts November 4; public release with iOS 27.3 in December.

Fast Update

Binance reopens, $3.64B leaves in 9.5 hours

Binance reopened withdrawals in phases on November 1; the first 9.5 hours saw a net outflow of $3.64 billion, 2.1% of reported assets. Flows are stabilizing.

Fast Update

Polymarket loses $2.7M to a hijacked third-party script

A page-speed script from DebugBear on Polymarket's site was replaced with malicious code on October 29. It used signed-in traders' sessions to move positions, hit 726 wallets, and Polymarket refunded $3.9 million.

Fast Update

DeepSeek open-sources Super-agent, a coding agent that works without being called

DeepSeek released its open-source Super-agent prototype on October 31: a coding agent that watches team chat and proposes fixes without being called. What shipped, its limits, and safe pilot conditions.

Fast Update

Google's satellite answers from orbit: the first haiku from a Super Intelligence chip

Google's prototype satellite answered its first prompt from orbit with a haiku from the Gemma 4 model. What it proves, its limits, and the twin-satellite plan for 2027.

Fast Update

Binance withdrawals are live in phase one as 95% of stolen funds are replaced

Binance opened phase one withdrawals November 1 and says 95% of the $6.3B stolen is replaced. What changed since the midday schedule, and what is still pending.

Fast Update

Binance reopens withdrawals in phases today, starting with 15 networks

Binance has set phase one of its withdrawal reopening for today, November 1, 06:00-09:00 UTC across 15 networks. Here is the schedule, Binance's own warning, and what is still unproven.

Fast Update

FBI blames North Korea for Binance's $6.3B hack; stolen funds moved into ether

The FBI says North Korea was behind the October 29 theft from Binance and asks crypto firms to block hundreds of linked addresses, as most of the stolen funds are converted into ether.

Fast Update

b14g loses 97 million CORE to unauthorized withdrawals; staking contracts paused

Bitcoin staking platform b14g paused affected contracts after unauthorized withdrawals on October 31; about 68 million CORE is still traceable on the Core network and 9 million was frozen by exchanges, while staked BTC was unaffected.

Fast Update

NYSE owner ICE brings Hyperliquid perps to the US; what HYPE holders get is still unclear

ICE and Trade[XYZ] agreed to build a regulated perpetuals venue on Hyperliquid, HYPE jumped to near $90, but nobody has said whether fees from the US venue flow back to HYPE holders.

Fast Update

Binance has replaced 90% of stolen funds; withdrawals reopen November 1

Two days after the $6.3 billion hack, Binance says 10 major assets are fully backed, the remaining 10% is still being sourced because those tokens are less liquid, and full reserve proof is due November 3.

Fast Update

October 31 Update: Super Intelligence's Access Fight, Bitcoin Holds $77K, and 3 Freebies Still Running

Mistral opens a 1-trillion-parameter model to everyone, Google locks down its top-ranked model, Bitcoin steadies after the Binance hack, plus a free VPS and free Super Intelligence video that are still live.

Market Update

Bitcoin Today: Binance's $6.3B Hack, BTC's Dip to $76K (Oct 31, 2026)

A cross-checked roundup of what X is talking about: the largest hack in crypto history at Binance, Bitcoin's market reaction, trending coins, and this week's open airdrop claim windows.

Beginner Guide

Crypto Airdrops for Beginners: How They Work, Requirements, and Reality

What a crypto airdrop is, why projects give away free tokens, the requirements they usually ask for, and the realistic outcomes to know before you start.

Testnet

How to Join Testnets Safely Without Risking Real Money

Testnets use fake money, but your accounts and wallet are real. How to join testnets safely: a dedicated wallet, official faucets, and verification habits.

Security

Anti-Scam Checklist Before Claiming Any Airdrop or Mint

Five two-minute checks before you connect your wallet to any claim or mint page: source, contract address, token approvals, costs, and time pressure.