Three separate attacks hit Bitcoin infrastructure in seven days, each exploiting a completely different layer of the custody chain. Between September 6 and September 12, attackers drained 4,000 Bitcoin from Blockstream's Liquid sidechain, minted 46.1 billion fake tokens on a cross-chain bridge, and tricked a bank into handing over customer passports and transaction histories. The lesson: where you store your Bitcoin determines whether you lose everything or stay protected.

What Exactly Went Wrong With Each Attack?

The three failures broke at completely different points in the chain between buyer and coin, which is why understanding each one matters for anyone holding Bitcoin.

On September 6, attackers exploited a bug in the Elements range-proof cache on Blockstream's Liquid sidechain. This flaw let them create L-BTC (Bitcoin-backed tokens) without any actual Bitcoin backing them, then swap the fake tokens for real Bitcoin. The attack drained close to 4,000 BTC, worth approximately $320 million, in a single transaction. Blockstream had published a fix for this bug on GitHub on September 1, five days before anyone exploited it, but the software update never reached the computers running Liquid. The attackers later returned 3,400 BTC after Blockstream patched the bridge nodes, then demanded a 10% bounty on the remaining 598.5 BTC and threatened Liquid users with a 15% loss. Blockstream refused, leaving roughly $47 million still gone.

Three days later, on September 11 at 04:28 UTC, Symbiosis suffered a different kind of failure. An attacker exploited its BridgeV2 smart contract and minted roughly 46.1 billion fake syBTC tokens, more than 2,000 times the total number of Bitcoin that will ever exist. However, only 4.39 WBTC (wrapped Bitcoin) sold through Uniswap before the market realized what was happening, netting the attacker about $336,000. Symbiosis recovered 15 BTC, offered a 20% bounty, and paused its Bitcoin bridge.

Revolut's breach came from social engineering, not code. On September 12, the bank disclosed that attackers had built a fake domain designed to look like an official law-enforcement portal. Using this fake site, they requested customer files and Revolut handed over passports, selfies, IBANs, and full Bitcoin transaction histories on high-net-worth accounts. While every Revolut customer kept the coins they held, a transaction history reveals how much someone owns and which addresses to target in future phishing attempts.

How Do Different Ways of Holding Bitcoin Protect You From These Attacks?

The custody method you choose determines which of these attacks could actually reach your coins. Each approach carries its own set of risks.

• Spot Bitcoin ETFs: A spot Bitcoin exchange-traded fund (ETF) gives you shares in a fund that holds the actual coins through a custodian. iShares Bitcoin Trust (NASDAQ: IBIT) held 99.93% of its assets in Bitcoin through a custodian as of March 14, 2026, on a 0.33% expense ratio. Only one of the three September attacks could reach an ETF shareholder: a breach at the custodian itself. Coinbase custodies most of the U.S. spot ETF market, so a breach there would hit almost every fund at once. In return for this protection, you give up the ability to spend the coins directly.
• Regulated Exchanges: When you hold Bitcoin on a regulated exchange, the coins sit on the exchange's own balance sheet. If the exchange collapses, customer coins go down with it. Two-factor authentication through an app beats a text message, because attackers can defeat SMS authentication through a SIM swap in an afternoon. An exchange works for buying, but makes a poor vault for a balance worth stealing.
• Self-Custody: Self-custody cuts every other party out of the equation, which means the holder carries every mistake alone. The seed phrase (the master key to your wallet) belongs on metal, never on paper and never on a screen. The holder should never type it into a device that has touched the internet, and should test the recovery process before the wallet holds anything worth losing. Hardware wallets fail too, as Coldcard owners found out in August when a firmware flaw cost them $70 million.

What's the Single Most Important Security Step Everyone Misses?

Revolut's attackers succeeded because they owned a domain that looked like Revolut's official site. The same trick works against every exchange and wallet vendor a customer might expect to hear from. This makes the browser address bar the only link worth trusting. A small test transaction on every new setup costs a few cents and catches most other problems before they become expensive.

Any service paying yield on Bitcoin is lending that Bitcoin to somebody else, which is how Liquid's users lost their money. The Consumer Financial Protection Bureau's 2025 consumer complaint report found that companies routinely deny fraud claims where the customer authenticated the transaction, so a scam the holder helped complete rarely gets refunded.

Which Custody Method Actually Avoided All Three Attacks?

For most people asking how to buy Bitcoin safely, the spot Bitcoin ETF is the answer, because none of the three failures between September 6 and September 12 reached a shareholder. In return, a buyer trusts Coinbase to keep the coins safe and gives up the ability to spend them. That works for anyone who wants the price appreciation and not the Bitcoin itself.

Anyone who wants the coins themselves gets the same answer from all three failures: fewer parties between a buyer and their Bitcoin means fewer ways to lose it, and every extra layer adds another way back. A bridge, a wrapper, a yield product, or a support line somebody can fake all count as additional risk. A breach at a custodian would put the ETF last instead of first, and until that happens, the order above stands.