Why keeping your private keys safe won’t always stop crypto theft

Almost 4,000 Bitcoin left Liquid's reserve on Sept. 6 through a withdrawal the network approved, even though the private keys used to authorize it hadn't been stolen. Software had accepted a withdrawal that should never have qualified.

Liquid lets people move a Bitcoin-backed token on a separate blockchain designed for faster, more private transactions. Bitcoin goes into a shared reserve, and users receive tokens called L-BTC, each intended to represent one BTC. When users redeem those tokens, the corresponding coins come out of the reserve.

According to TRM Labs' reconstruction of the attack, attackers exploited a software flaw to create L-BTC without putting in the Bitcoin to back it, and then exchanged those tokens for real coins. The operators responsible for approving withdrawals essentially trusted information that was wrong.

If you've spent years hearing that protecting your keys means protecting your crypto, this takes a moment to absorb. Private keys are the secrets that authorize transactions, and keeping them away from thieves is essential. But software can still use those keys to approve the wrong payment. Think of several people signing off on a withdrawal while all consulting the same incorrect account balance.