When almost 4,000 Bitcoin left Liquid’s reserve on September 6, the story was not simply about stolen private keys. The withdrawal was approved by the network, even though the keys used to authorize it had not been compromised.
The problem was software. According to TRM Labs’ reconstruction, attackers exploited a flaw that allowed them to create L-BTC without depositing the Bitcoin needed to back it. They then exchanged those tokens for real BTC from Liquid’s reserve.
It is a useful reminder that crypto security does not end with protecting a private key. A key can remain secret while the software using it approves a payment that should never have happened.
Liquid’s system is built around a Bitcoin reserve backing L-BTC, a token used on a separate blockchain designed for faster and more private transactions. Users can redeem L-BTC for the Bitcoin held in the reserve.
In this case, the machinery accepted a false signal. The attackers effectively created assets that looked legitimate to the system and used them to withdraw genuine Bitcoin.
That creates a second problem, one that starts after the technical breach: who is responsible for making customers whole?
Crypto insurance sounds like an obvious answer. In practice, the word “insured” can conceal a lot of conditions.
Crypto insurance is not the same as customer protection
Coinbase provides a clear example of why the details matter. The company says its crime insurance covers a “portion” of digital assets held across its storage systems against theft, including losses connected to cybersecurity breaches.
But Coinbase also warns that total losses could exceed the amount recovered through insurance. Even when an incident falls within the policy, customers could still face losses.
The same disclosure draws another important line. Losses caused by unauthorized access to an individual account because login credentials were compromised or lost are excluded from that coverage.
So two customers could both discover that Bitcoin has disappeared and still face very different outcomes, depending on how the loss occurred.
That distinction is easy to miss when insurance is reduced to a marketing line. A company can hold a policy without that automatically meaning every customer is entitled to full reimbursement.
There is also a basic question of whose loss the policy is actually designed to cover.
If the insured party is the company holding the Bitcoin, the insurance contract is between that business and its insurer. Whether a customer can make a claim directly, or how an eventual payout reaches customers, depends on the relevant legal and contractual arrangements.
An account balance does not reveal any of that.
The insurance payout may not cover the whole hole
A company’s obligation to its customers is separate from the amount its insurer agrees to pay.
If a business owes customers more than an insurance policy recovers, the company still has to deal with the difference under its own obligations. The size of an insurance policy, by itself, does not establish what any individual customer is owed.
This is one reason two services can both advertise insurance while offering materially different levels of protection.
One provider might commit to replacing specific losses and have enough resources to cover a gap between customer obligations and insurance proceeds. Another might provide a narrower form of protection.
For customers, the important question is not simply whether insurance exists. It is what the business has promised to repay, under which circumstances, and with what resources behind that promise.
Crypto insurance also should not be confused with the protection people may associate with traditional bank deposits.
In the United States, the FDIC protects eligible deposits when an insured bank fails. That does not extend to digital assets, even when those assets are purchased through an insured bank.
The money and crypto displayed inside the same app can therefore sit under completely different protection systems.
Software can fail without a private key being stolen
The Liquid incident also highlights a less familiar category of risk: losses caused by software rather than a compromised key.
Relm, an insurer specializing in crypto businesses, describes digital asset crime coverage that can respond to infrastructure exploits and theft involving smart contracts, the programs that execute transactions automatically.
The company also offers technology errors and omissions coverage for claims connected to problems with a company’s products or services. Depending on the policy, that can include legal defense costs and a covered settlement or judgment.
Those are not necessarily the same as replacing assets directly lost by a business.
Consider a hypothetical custody provider using another company’s software to process withdrawals. If a software error allows Bitcoin to leave improperly, the custodian might rely on its own insurance or pursue a claim against the software provider.
Customers, meanwhile, are still waiting for access to their balances.
Their need does not pause while companies determine who was responsible, insurers review the incident, or legal claims take shape. Whether the custodian pays customers immediately depends on its contractual obligations and financial capacity.
Liquid makes the distinction especially visible. Bitquery’s investigation found that 3,400 BTC were returned on September 7. CryptoSlate later reported on September 12 that Blockstream had rejected a demand for a bounty.
Returned coins reduce the size of the missing reserve. They do not, on their own, determine who is responsible for any remaining shortfall.
Getting your dollars back may still leave Bitcoin missing
Even when compensation is agreed, another question appears: what exactly counts as being repaid?
A customer who lost one Bitcoin may naturally expect one Bitcoin in return. But an agreement could instead specify a dollar value.
Imagine one BTC is worth $80,000 when it disappears. If compensation is fixed at $80,000 but Bitcoin rises to $100,000 before the payment arrives, the customer receives the promised dollar amount but can now buy only 0.8 BTC.
The difference is not a detail. It determines who absorbs the risk of Bitcoin’s price movement while a claim is being resolved.
Different agreements can use different valuation dates or provide for repayment in Bitcoin instead of dollars. The terms decide what the customer actually receives.
The same issue can arise after assets are recovered.
If an insurer pays out and missing Bitcoin later returns to the reserve, there still needs to be a mechanism for determining who gets those recovered coins. Recovering an asset and allocating it to the people entitled to it are separate problems.
There is also the cost of being unable to use the money during the dispute. Someone could eventually receive every missing coin and still have spent weeks unable to move savings or meet a payment.
That consequence does not disappear merely because the original asset comes back.
The larger issue is transparency. Asking customers to do their own research is of limited use when the risks involve software architecture, insurance contracts, liability policies and arrangements most customers will never see.
Providers can make that easier by explaining reimbursement as clearly as they explain fees: which losses they agree to cover, whether repayment means coins or dollars, and how they would finance any gap between what they owe customers and what an insurer pays.
The Liquid incident began with software accepting something it should have rejected. The financial consequences show why protecting assets is only one part of the equation.
Security can reduce the chance of losing crypto. Crypto insurance can help with some losses. Neither answer, by itself, tells customers who ultimately carries the cost when something breaks.