How to Buy Bitcoin Safely After a Week of Hacks: What Liquid, Symbiosis, Revolut and Coldcard Got Wrong

Three separate Bitcoin failures hit in seven days, and each one broke at a completely different point in the chain between buyer and coin. Which layer you trust determines whether you were safe or wiped out.

This post may contain links from our sponsors and affiliates, and Flywheel Publishing may receive compensation for actions taken through them.

Three separate failures hit Bitcoin (CRYPTO: BTC) in seven days. Attackers drained $320 million from a sidechain, minted 46.1 billion fake tokens on a cross-chain bridge, and tricked a bank into handing over customer passports and full Bitcoin transaction histories.

One came from broken code, one from a broken contract, and one from a bank that fell for a fake email. So how to buy Bitcoin safely depends on who you let hold the coins.

Each of the Three Failures Broke at a Different Point

Attackers drained Blockstream’s Liquid sidechain on September 6. A bug in the Elements range-proof cache let them create L-BTC with no Bitcoin behind it and swap it for real Bitcoin. Close to 4,000 BTC, worth about $320 million, left the federation wallet in a single transaction.

The attackers sent 3,400 BTC back the next day once Blockstream patched the bridge nodes, then demanded a 10% bounty on the remaining 598.5 BTC and threatened Liquid users with a 15% loss. Blockstream refused, so roughly $47 million is still gone. However, the fix for that bug had been public on GitHub since September 1, five days before anyone used it, and no software update ever carried it to the computers running Liquid.