Almost 4,000 Bitcoin were moved out of Liquid's reserve on September 6 through a withdrawal that the network approved despite the private keys used to authorize it not being stolen. Software had accepted a withdrawal that should never have qualified. Liquid allows users to move Bitcoin-backed tokens on a separate blockchain designed for faster, more private transactions. Bitcoin enters a shared reserve, and users receive tokens called L-BTC, each intended to represent one BTC. When users redeem those tokens, the corresponding coins are released from the reserve. According to TRM Labs' reconstruction of the attack, attackers exploited a software flaw to create L-BTC without depositing the backing Bitcoin, then exchanged those tokens for real coins. The operators responsible for approving withdrawals trusted information that was incorrect. The incident highlights how private keys, which authorize transactions, can still be used to approve unauthorized payments when software malfunctions. Multiple parties may sign off on a withdrawal while referencing the same erroneous account balance. Once such an error occurs, attention shifts from technical explanation to the broader question of who bears the financial responsibility. Crypto insurance can offer some relief, but policy terms often limit its effectiveness. The company may be insured for specific losses or legal claims, yet still fail to provide full repayment to all affected customers. Insurance payouts might fall short of the value needed to restore the missing assets. Understanding the gap between an insurer's payment and a customer's account requires examining the process between a company's claim and the individual's balance. The term 'financial protection' can therefore mean something different than customers expect. The company holds insurance coverage, but the extent of that coverage for end users depends on policy details and legal arrangements. Insurance typically covers the institution holding the assets, not necessarily the individual account holders. Direct claims by customers and the speed of compensation depend on contractual obligations and available funds. Liquid's case illustrates how asset recovery and accountability are distinct processes. Blockchain analysis by Bitquery showed that attackers returned 3,400 BTC the following day. On September 12, Blockstream declined a request for a bounty related to the incident. Each returned coin reduces the shortfall in the reserve, but repayment by an attacker does not determine who must cover any remaining deficit. That obligation is governed by existing commitments, not by blockchain records alone. Compensation for lost assets does not always equate to receiving equivalent cryptocurrency. A policy might promise repayment in fiat value, which could purchase fewer coins if market prices have risen. Conversely, a drop in price could mean the restored amount buys more. The agreement governing repayment defines who assumes the risk of price fluctuations. Some arrangements specify replacement in cryptocurrency units, while others use fixed dollar valuations. Recovered assets must also be allocated among eligible claimants, a process separate from simply restoring them to wallets. Delays in resolution can prevent users from accessing funds for extended periods, creating additional hardship beyond the loss itself. Reimbursement for lost functionality requires separate consideration. The incident underscores limitations in advising users to 'do their own research,' as few can audit the software validating their withdrawals or negotiate insurance terms. Financial service providers should clarify reimbursement policies as transparently as they explain fees, specifying which losses they commit to covering and how shortfalls will be addressed. Customers need to understand whether protection is backed by sufficient reserves. The root cause of Liquid's shortfall was software accepting invalid withdrawal requests. The broader lesson for asset custodians is that security reduces the likelihood of loss, but financial safeguards determine how losses are distributed. Clear communication about risk allocation remains essential for users relying on third-party platforms.