tfw you lose 300 million in BTC (LIQUID BITCOIN HACK)

— Liquid Network suffered a ~$320 million theft of approximately 4,000 BTC due to a code vulnerability exposed on GitHub from August 3 to early September; the attacker returned 3,600 BTC but kept 400 as a gray-hat recovery fee.

— Liquid is an IOU system backed by an 80+ member federation, not self-custodial Bitcoin; users depend entirely on federation members to redeem their L-BTC.

— The vulnerability was publicly visible for over a month before exploitation, raising questions about responsible disclosure and code maintenance standards at Blockstream.

— Trezor's third-party shipping provider breach exposed 67,000 additional US customers (orders from Nov 2019–Aug 2021) with names, emails, phone numbers, and shipping addresses.

— MetaPlanet, a Japanese Bitcoin treasury company, diluted shareholder shares by roughly 10x while insiders received favorable stock options with adjustment provisions, protecting executive holdings from dilution.

— Hardware wallet ecosystem has shifted post–Cold Card; newer options like Foundation Passport offer multi-sig and app flexibility, though no single device fully addresses invasion-attack scenarios.

— Never hold more than $100–$300 in L-BTC or other pegged sidechains; set a recurring plan to move holdings to self-custody Bitcoin on-chain or Lightning every 1–6 months.

— When evaluating Bitcoin treasury companies, scrutinize equity dilution, insider compensation terms, and lock-up periods; avoid second-tier plays (non-MicroStrategy) where optics and insider gain heavily outweigh public shareholder benefit.

— For hardware wallets, prioritize devices that balance intuitive spouse/heir usability with out-of-home storage and multi-sig optionality; consider Foundation Passport for sovereignty features or Seed Signer for complete air-gap control, but accept trade-offs exist on every device.