For years the retail mantra was simple: protect the keys, protect the coins. Liquid just reminded everyone that software can authorize the wrong payment even when the private keys never leave the building. According to CryptoSlate’s Sep 20 analysis, nearly 4,000 Bitcoin left Liquid’s reserve on September 6 through a withdrawal the network approved—without anyone stealing the signing secrets.
That flips the customer question from “was it hacked?” to “who pays to put the money back?” CryptoSlate’s blunt answer: saying a crypto company has insurance tells you almost nothing about what happens to you.
How coins left without a classic key theft
Liquid lets users move a Bitcoin-backed token on a sidechain built for faster, more private transfers. BTC goes into a shared reserve; users receive L-BTC meant to represent one BTC each. Redeeming L-BTC is supposed to pull the matching coins back out.
TRM Labs’ reconstruction, as summarized by CryptoSlate, says attackers exploited a software flaw to create L-BTC without depositing the Bitcoin that should have backed it, then redeemed those tokens for real coins. The operators approving withdrawals trusted bad information—like several people signing a check after looking at the same wrong balance sheet.
Private keys still matter. They just do not save you when the software using those keys is wrong.
“Insured” is not a customer receipt
CryptoSlate walks through the ugly middle layer between a company’s claim and a user’s account:
- A policy may cover losses to the company, or liability claims against it, without promising every customer full repayment.
- Even a successful insurer payout can be sized in dollars while the customer lost Bitcoin—leaving a shortfall if BTC rises before settlement.
- You usually cannot see the policy from your balance screen, so “we’re insured” is marketing, not a term sheet.
Coinbase’s public crime-insurance language is the useful foil. The company says coverage protects a “portion” of assets across storage systems against theft, warns that total losses can exceed recoveries, and excludes some account takeovers caused by compromised login credentials. Same missing-money outcome; different coverage depending on how it happened. That is the opposite of FDIC-style certainty—and CryptoSlate notes FDIC does not insure digital assets even when they sit next to cash in a bank app.
Software theft can be insurable—and still leave a gap
Specialist insurer Relm describes digital-asset crime coverage that can respond to infrastructure exploits and smart-contract theft even when keys stay secure, plus errors-and-omissions coverage aimed at defending claims rather than instantly replacing customer coins. Imagine a custodian relying on another firm’s withdrawal software: both companies may have policies; customers still want balances restored today while insurers argue.
Liquid also shows recovery ≠ responsibility. Bitquery’s investigation, per CryptoSlate, says attackers returned 3,400 BTC on September 7. On September 12, Blockstream rejected a bounty demand. Coins coming back shrink the hole. They do not automatically decide who funds whatever remains.
Coins vs dollars, and the cost of waiting
CryptoSlate’s hypothetical is the one retail should memorize. Lose 1 BTC when it is worth $80,000; get an $80,000 payout later when BTC is $100,000; you were “made whole” in dollars and still short 0.2 BTC. Price moves either way assign risk to someone—the contract decides who. Recoveries after an insurer pays raise another allocation fight: who gets the returned coins?
Then there is opportunity cost. Getting every coin back weeks later does not undo payments you could not make while balances were frozen. That harm needs its own contractual basis, and most retail terms never spell it out in plain language.
Geeknewz take
Liquid’s lesson is not “keys are fake.” Keys are necessary and insufficient. The grown-up diligence question for any custodial or federated Bitcoin product is reimbursement literacy: which losses the firm undertakes to repay, whether repayment means coins or dollars, and how it funds the gap between what customers are owed and what an insurer will write a check for. Security reduces the chance of a loss. Financial protection decides how the loss is shared. Customers deserve that share before they are asked to bear it.
Source: CryptoSlate — Who pays when Bitcoin disappears without anyone stealing keys? (Andjela Radmilac, Sep 20, 2026).