Step chart of bitcoin added to the Liquid Federation's main wallet since October 20. The line rises by 2.53 BTC at block 973,420 and 50 BTC at block 973,548, then by 300 BTC at block 974,299 and 250 BTC at block 974,307, reaching the dashed blue line marking the 602.53 BTC shortfall.
Our own chart, built from transactions checked against our node and the shortfall published by liquid.network on October 20, 2026.

Liquid is back to 1:1 after four deposits worth 602.53 BTC, checked against our node

NodeWitness Team 6 min read

The hole is closed. Four bitcoin transactions carried 602.53048101 BTC into the Liquid Federation's main wallet, enough to cover the shortfall left by the September exploit with 28,800 sats to spare. The chain confirms the amounts. Who signed them is a matter of someone's word.

Liquid's peg is whole again. In a statement posted early on November 3, the Liquid Federation said the network's bitcoin reserves "have been fully restored, reestablishing 1:1 BTC backing for all LBTC" [1]. Blockstream echoed it later that day, adding that anyone running a Liquid node can verify it [3]. JAN3, the company behind the AQUA wallet, said it had kept honoring Lightning swaps at 1:1 "from our own reserves the entire time" [4].

When we last looked, on October 20, the reserve held 3,632.23 BTC against 4,234.76 L-BTC, a gap of 602.53 BTC (our earlier piece explains how it opened). We said we would come back with the block and the transaction if the money arrived. Here they are.

Four deposits, block by block

Samson Mow, JAN3's chief executive and, in his own words, a member of the Federation's board, called out the deposits on X as they landed [2]. We located each one on the bitcoin chain with our own node. All four went to the Federation's main address, bc1qdlld…xxr, the same one that received the 3,400 BTC the attacker returned on September 7.

Date Block Transaction Amount
Oct 27 973,420 98fd4842…d020 2.53048101 BTC
Oct 28 973,548 bc130513…fd15 50 BTC
Nov 2 974,299 2701150a…4ed5 300 BTC
Nov 2 974,307 531088ee…ef55 250 BTC
Total 602.53048101 BTC

The October 20 shortfall stood at 602.53019301 BTC [7]. The deposits beat it by 28,800 sats [8]. At mempool.space's November 3 price of $77,516, the four transfers are worth about $46.7 million [7].

Mow described the first one as a test transaction that brought the shortfall down to 600 BTC [2]. The amount fits, since it covers the odd 0.53 almost to the sat. The 50 BTC followed the next day, and on November 2 the last 550 BTC arrived in two blocks just eight apart [8].

Four transactions, 602.53048101 BTC, and a September hole closed with 28,800 sats left over.

What the chain says about the sender

The chain links the deposits in pairs. The 2.53 BTC and the 50 BTC both spend from the same address, bc1q3m7l…sdj. The 250 BTC deposit spends the change output of the 300 BTC one, so those two belong together as well [8]. Every one of them is signed with a single key, the way an ordinary wallet spends [8]. The reserve itself sits behind a script that needs 11 of 15 Federation signatures.

What the chain cannot show is who owns those keys. The attribution rests on Mow, who answered the question of where the coins came from with "As stated many times, Blockstream" [2]. The Federation's statement does not name the source, Blockstream's post does not claim it either [1][3], and SideSwap says that question is for the Federation to answer [6].

Running the numbers on the reserve

The check we proposed in October was a single subtraction, L-BTC in circulation minus bitcoin in reserve. On November 3, liquid.network's API put the reserve at 4,272.97388819 BTC and L-BTC in circulation at 4,272.97388767 [7]. The reserve is 52 sats ahead.

We repeated the bitcoin side on our own node at block 974,431. The 35 addresses the explorer lists hold exactly 4,272.97388819 BTC, the same figure to the sat [8]. On top of that sits the 9,737-sat dust output on an old address that the explorer leaves out, unchanged since October. The main address holds 99.05% of the reserve.

L-BTC in circulation has grown by about 38 since October 20. The asset's own stats show 33 new peg-ins worth 38.21524354 BTC over that stretch [7]. Each of them adds the same amount to both sides, so none of it narrows the gap. Only the four deposits in the table do.

The Federation has also been shuffling its coins. The 3,400 BTC returned by the attacker was spent on October 26 in block 973,298, pooled with 20 other inputs and split into ten coins of roughly 340 BTC each, all back to the main address [8]. The oldest coin left in the reserve dates from block 967,051. It is 684 blocks, about five days, short of the 8,064-block timelock after which the 2-of-3 emergency keys could also spend it [8]. liquid.network's list of expired coins is empty [7].

What stands between users and peg-outs

Full backing has not switched Federation peg-outs back on. On October 27 the Federation said peg-outs "remain subject to enhanced operational controls while security hardening continues and the independent security audit nears completion" [5]. The November 3 statement gives no date and promises more on governance changes and new safeguards [1].

The L-BTC asset record tells the same story. Between our October 20 and November 3 readings, the peg-out count stayed at 10,414 and the total pegged out did not move by a single sat [7]. Money has only flowed in.

In practice, exits run through providers. SideSwap says every peg-out it processes is paid from its own bitcoin wallet, topped up by hand, and that payouts can sit in a queue when that wallet runs low [6]. AQUA and Bull Bitcoin also swap L-BTC for bitcoin at 1:1 [5]. Two old rules hold. No legitimate exit ever asks for your seed, and sending bitcoin straight to a Federation address does not get you L-BTC.

On October 20 the subtraction came to 602.53. On November 3 it came to minus 0.00000052. The next milestone is the Federation paying out on its own again.

For more on-chain and price data, see our Market section.

Sources

Source type in brackets.

  1. Liquid Federation, Update from the Liquid Federation, November 3, 2026. Reserves restored, 1:1 for all L-BTC, governance changes and safeguards to come. (Primary, official X account)
  2. Samson Mow, X posts on the 2.5 BTC test deposit (October 27, 2026), the 300 BTC, where the coins come from, his board seat and the 250 BTC (November 2, 2026). (Primary, statements on X)
  3. Blockstream, post on X, November 3, 2026. (Primary, official X account)
  4. JAN3, post on X, November 3, 2026. (Primary, official X account)
  5. Liquid Federation, Update from the Federation, October 27, 2026. 1:1 swaps via AQUA, Bull Bitcoin and SideSwap, Federation peg-outs under enhanced controls, independent audit. (Primary, official X account)
  6. SideSwap, The Liquid peg is back to one to one, November 3, 2026. Deposit timeline, Federation peg-outs not yet back, payouts from SideSwap's own wallet. (Primary, provider)
  7. mempool, Liquid Federation Holdings and its public API (pegs, reserves, addresses and L-BTC asset stats), queried on November 3, 2026 (Liquid block 4,129,437, Bitcoin block 974,430), with the mempool.space price. October 20 figures from the reading published in our piece that day. (Secondary, open-source on-chain explorer)
  8. Bitcoin transactions checked against our node at block 974,431 on November 3, 2026: 2.53 BTC, 50 BTC, 300 BTC, 250 BTC and the split of the returned 3,400 BTC, plus balances and coins for the reserve addresses. (Primary, chain data)

More in Network and mining

See all 17 articles in Network and mining →

Last updated: November 3, 2026