Three separate attacks hit Bitcoin infrastructure in seven days, each breaking at a completely different point in the chain between buyer and coin. A bug in Blockstream's Liquid sidechain let attackers mint 4,000 Bitcoin (BTC) out of thin air; a smart contract flaw on Symbiosis minted 46.1 billion fake tokens; and a fake government email tricked Revolut into handing over customer passports and Bitcoin transaction histories. Understanding where each failure occurred is the key to knowing which custody method actually protects your coins.

What Went Wrong at Liquid, Symbiosis, and Revolut?

On September 6, attackers exploited a bug in the Elements range-proof cache on Blockstream's Liquid sidechain, a Bitcoin sidechain that lets users trade Bitcoin-backed tokens faster and cheaper than on the main Bitcoin network. The vulnerability allowed them to create L-BTC (Liquid Bitcoin) without any actual Bitcoin backing it, then swap the fake tokens for real Bitcoin. Close to 4,000 BTC, worth approximately $320 million, left the federation wallet in a single transaction.

The attackers returned 3,400 BTC the next day after Blockstream patched the bridge nodes, then demanded a 10% bounty on the remaining 598.5 BTC and threatened Liquid users with a 15% loss if they refused. Blockstream declined, leaving roughly $47 million still missing. The critical detail: the fix for this bug had been public on GitHub since September 1, five days before anyone exploited it, but no software update ever reached the computers running Liquid.

Three days later, Symbiosis broke for an entirely different reason. At 04:28 UTC on September 11, an attacker exploited its BridgeV2 smart contract and minted roughly 46.1 billion fake syBTC tokens, more than 2,000 times the total number of Bitcoin that will ever exist. Only 4.39 wrapped Bitcoin (WBTC, a tokenized version of Bitcoin on other blockchains) sold through Uniswap before the market realized what the tokens were, netting the attacker about $336,000. Symbiosis recovered 15 BTC, offered a 20% bounty, and paused its Bitcoin bridge.

Revolut's breach came from social engineering, not code. On September 12, the bank disclosed that attackers had built a fake domain designed to look like an official law-enforcement portal and used it to request customer files. Revolut handed over passports, selfies, IBANs (International Bank Account Numbers), and full Bitcoin transaction histories on high-net-worth accounts without verifying the request. Every Revolut customer kept the coins they held, but a transaction history tells a phisher exactly how much a customer owns and which addresses to target next.

Where Is Your Bitcoin Actually Safe?

Each of the three failures broke at a different layer of the custody chain, which means each custody method protects you from different risks. A spot Bitcoin ETF (exchange-traded fund), a regulated exchange, and self-custody all carry distinct vulnerabilities.

A spot Bitcoin ETF like iShares Bitcoin Trust (NASDAQ: IBIT) holds Bitcoin through a custodian, meaning you own shares in a fund rather than the coins themselves. As of March 14, 2026, IBIT held 99.93% of its assets in Bitcoin through a custodian, with a 0.33% expense ratio. Only one of the three failures from that week could reach an ETF shareholder: a breach at the custodian. Coinbase custodies most of the U.S. spot ETF market, so a breach there would hit almost every fund at once.

A regulated exchange holds coins on its own balance sheet, so a collapse there takes customer coins down with it. Two-factor authentication through an app beats a text message, because a SIM swap (where an attacker tricks a mobile carrier into transferring your phone number to their device) defeats SMS in an afternoon. An exchange works for buying, but makes a poor vault for a balance worth stealing.

Self-custody cuts every other party out, and the holder carries every mistake alone. The seed phrase (the backup code that unlocks a wallet) belongs on metal, never on paper and never on a screen. The holder never types it into a device that has touched the internet, and tests the recovery before the wallet holds anything worth losing. Hardware wallets fail too, as Coldcard owners found out in August when a firmware flaw cost them $70 million.

How to Protect Yourself From These Three Attack Types

• Verify the address bar: Revolut's attackers won because they owned a domain that looked like Revolut's. The same trick works against every exchange and wallet vendor a customer might expect to hear from, which makes the browser address bar the only link worth trusting. Always check that you are on the correct website before entering credentials or approving transactions.
• Avoid yield products: Any service paying yield on Bitcoin is lending that Bitcoin to somebody, which is how Liquid's users lost their money. The Consumer Financial Protection Bureau's 2025 consumer complaint report found that companies routinely deny fraud claims where the customer authenticated the transaction, so a scam the holder helped complete rarely gets refunded.
• Test with small amounts first: A small test transaction on every new setup costs a few cents and catches phishing attempts, address errors, and other problems before you move significant amounts. This simple step catches most social engineering attacks and technical failures before they become expensive.
• Understand custody trade-offs: Fewer parties between a buyer and their Bitcoin means fewer ways to lose it, and every extra layer adds a way back. A bridge, a wrapper, a yield product, or a support line somebody can fake all count as additional risk vectors.

The ETF avoids everything that broke during that week except the custodian risk. None of the three failures between September 6 and September 12 reached a shareholder, because none of them touched the custodian layer. In return, a buyer trusts Coinbase to keep the coins safe and gives up the ability to spend them. That works for anyone who wants the price appreciation and not the Bitcoin itself.

Anyone who wants the coins themselves gets the same answer from all three failures: fewer parties between a buyer and their Bitcoin means fewer ways to lose it. A breach at a custodian would put the ETF last instead of first, and until that happens, the order stands. The key insight is that no single custody method is universally safe; instead, each method is safe from different attacks. Your choice depends on which risks matter most to you.