Almost 4,000 Bitcoin left Liquid's reserve on Sept. 6 through a withdrawal the network approved, even though the private keys used to authorize it hadn't been stolen. Software had accepted a withdrawal that should never have qualified.

Liquid lets people move a Bitcoin-backed token on a separate blockchain designed for faster, more private transactions. Bitcoin goes into a shared reserve, and users receive tokens called L-BTC, each intended to represent one BTC. When users redeem those tokens, the corresponding coins come out of the reserve.

According to TRM Labs' reconstruction of the attack , attackers exploited a software flaw to create L-BTC without putting in the Bitcoin to back it, and then exchanged those tokens for real coins. The operators responsible for approving withdrawals essentially trusted information that was wrong.

If you've spent years hearing that protecting your keys means protecting your crypto, this takes a moment to absorb. Private keys are the secrets that authorize transactions, and keeping them away from thieves is essential. But software can still use those keys to approve the wrong payment. Think of several people signing off on a withdrawal while all consulting the same incorrect account balance.

Once that happens, you stop looking for the technical explanation and start asking the billion-dollar question: who pays to put the money back?

Crypto insurance can help, but just having a policy might not be the fast and easy solution. The company may be insured for certain losses, or for claims brought against it, without promising every customer full repayment. Even when an insurer pays, the amount might fall short of what it takes to replace the missing coins.

To understand that, we need to look at what happens between the company's insurance claim and the customer's account. It's where the promise of ‘financial protection' can turn out to mean a completely different thing than people expect.

People entrust assets to financial services because they want someone else to handle work they can't do themselves. That includes protecting the money, and it can also include taking responsibility when those protections fail. Insurance can support that responsibility, although the terms determine how much support it actually provides.