Almost 4,000 Bitcoin left Liquid’s reserve on Sept. 6 through a withdrawal the network approved, even though the private keys used to authorize it hadn’t been stolen. Software had accepted a withdrawal that should never have qualified.
Liquid lets people move a Bitcoin-backed token on a separate blockchain designed for faster, more private transactions. Bitcoin goes into a shared reserve, and users receive tokens called L-BTC, each intended to represent one BTC. When users redeem those tokens, the corresponding coins come out of the reserve.
According to TRM Labs’ reconstruction of the attack, attackers exploited a software flaw to create L-BTC without putting in the Bitcoin to back it, and then exchanged those tokens for real coins. The operators responsible for approving withdrawals essentially trusted information that was wrong.
If you’ve spent years hearing that protecting your keys means protecting your crypto, this takes a moment to absorb. Private keys are the secrets that authorize transactions, and keeping them away from thieves is essential. But software can still use those keys to approve the wrong payment. Think of several people signing off on a withdrawal while all consulting the same incorrect account balance.
Once that happens, you stop looking for the technical explanation and start asking the billion-dollar question: who pays to put the money back?
Crypto insurance can help, but just having a policy might not be the fast and easy solution. The company may be insured for certain losses, or for claims brought against it, without promising every customer full repayment. Even when an insurer pays, the amount might fall short of what it takes to replace the missing coins.
To understand that, we need to look at what happens between the company’s insurance claim and the customer’s account. It’s where the promise of ‘financial protection’ can turn out to mean a completely different thing than people expect.
The company is insured, but what about you?
People entrust assets to financial services because they want someone else to handle work they can’t do themselves. That includes protecting the money, and it can also include taking responsibility when those protections fail. Insurance can support that responsibility, although the terms determine how much support it actually provides.
Coinbase offers a pretty good example in its public explanation of its insurance. The company says its crime insurance protects a “portion” of the digital assets held across its storage systems against theft, including cybersecurity breaches. It also warns that total losses could exceed insurance recoveries, leaving customers with losses even when the incident is covered.
The policy excludes losses from unauthorized access to an individual account caused by compromised or lost login credentials. So the same outcome for two customers, money missing from their accounts, could involve different coverage depending on how it happened.
Coinbase’s disclosure explains more than the word “insured” ever could. It tells customers that protection has limits, and that the cause and size of a loss affect what the insurance can provide. Someone reading only that the business has coverage would miss both qualifications.
There’s a familiar comparison that can make this harder to understand. In the US, the FDIC protects eligible deposits when an insured bank fails. But it doesn’t insure digital assets, even when they’re bought through an insured bank. Cash and crypto can appear next to each other in an app and come with very different protections.
With private insurance, the first thing to establish is whose loss the policy covers. If the insured party is the company holding your Bitcoin, the insurer’s agreement is with that company. Whether you can claim directly, and how any payout reaches you, depends on the applicable arrangements and law. And you can’t see that from your account balance.
The company’s obligations to you are also separate from its insurance. If it owes customers more than its insurer will pay, it needs another source of money to meet the difference. Conversely, knowing the size of an insurance policy doesn’t establish what the company owes any particular customer.
This is why two services can both advertise insurance and offer different levels of financial protection. One might promise to replace specified losses and have enough money to cover an insurance shortfall, while another might make a more limited commitment. Customers need to know what they’re being promised and whether the business can afford to honor it.
Software fails, and the bill needs an owner
Software-driven theft can be insurable even when private keys stay secure. Relm, a specialist insurer serving crypto businesses, describes digital asset crime coverage that can respond to infrastructure exploits and theft involving smart contracts, the programs that carry out transactions automatically.
The same insurer offers technology errors and omissions coverage, which addresses claims arising from problems with a company’s products or services. Depending on the policy, it can pay for defending a claim and for a covered settlement or judgment. But that serves a different purpose from directly reimbursing the business for assets it lost.
Imagine a company that stores Bitcoin for customers and relies on another company’s software to process withdrawals. If a software mistake lets money leave, the storage provider might seek payment under its own coverage. It might also pursue a claim against the software firm, whose liability policy could help pay what that firm owes.
The customers, meanwhile, want access to their balances. Their need is immediate, even while the businesses establish responsibility and insurers assess claims. Whether the storage provider pays customers during that process depends on its obligations and its ability to fund repayment.
Liquid shows why recovering assets and assigning responsibility are two different tasks. According to Bitquery’s investigation, the attackers returned 3,400 BTC on Sept. 7. On Sept. 12, CryptoSlate reported that Blockstream had rejected a demand for a bounty.
Every coin returned reduces the amount needed to restore the reserve. But repayment from an attacker doesn’t determine who must contribute any shortfall. That depends on obligations which the transaction record, however detailed, cannot establish on its own.
Getting your dollars back isn’t always getting your Bitcoin back
Even an agreed payout needs a definition of what’s being replaced. People who held Bitcoin may expect the same number of coins, but their compensation agreement might instead specify a dollar amount.
Consider a hypothetical loss of one Bitcoin worth $80,000. Suppose compensation is fixed at that value, but Bitcoin costs $100,000 when the payment is made. The recipient gets the promised $80,000, which now buys only 0.8 BTC. The dollar amount has been repaid in full, while a fifth of the original Bitcoin holding is still missing.
If the price falls during the wait, the same dollars can buy more Bitcoin. The point is that the agreement determines who bears the risk of those price movements. This example describes no particular policy; contracts can use different valuation dates or provide for replacement in coins.
Recoveries need rules too. If an insurer pays and some of the missing Bitcoin is subsequently returned, the agreement must account for who receives them. Getting coins back into a wallet is just one step in resolving a loss: allocating them among the people entitled to repayment is a whole other issue.
Then there’s the cost of being unable to use the money. Someone who eventually gets every coin back may have spent weeks unable to meet a payment or move their savings. Replacing the asset doesn’t automatically compensate for those consequences, which would need their own basis for repayment.
These complications expose a limit to the instruction that customers should do their own research. Few people can inspect the software approving their Bitcoin withdrawals. Fewer still can compare its possible failures with an insurance policy they may never see, negotiated between their provider and another business.
Choosing a financial service shouldn’t require that level of expertise. Providers should explain reimbursement as plainly as they explain fees, stating which losses they undertake to repay and whether repayment means coins or dollars. They should also explain how they would fund a gap between what they owe customers and what their insurer pays.
That information would let people judge the price of accepting more risk themselves. Some will choose a cheaper service with limited protection, while others will pay more for a business to take on obligations backed by enough money to meet them.
Liquid’s missing Bitcoin started with software accepting something it should have rejected. The biggest lesson here reaches anyone relying on a company to protect their assets: security reduces the chance of a loss, while financial protection determines how that loss is shared. Customers deserve to know their share before they’re asked to bear it.
Analysis,Crime,Featured,Hacks,Insurance#pays #Bitcoin #disappears #stealing #keys1789937086
