I’m tired, boss.

This week, we witnessed another devastating attack on the Bitcoin ecosystem as the Liquid Network was drained of more than $320 million worth of BTC.

The negotiations between Blockstream and the self-described “white hat” hackers played out publicly through OP_RETURN messages. The hackers eventually returned 3,400 BTC before defiantly telling Adam Back’s company they wanted 400 BTC as a “bug bounty,” or they would keep the remaining 600 BTC for themselves.

It makes for a fascinating case study in business negotiations and the blurry boundaries of ethical hacking. But the wider lesson is harder to ignore. Bitcoin has been under relentless attack from increasingly AI-empowered adversaries for months now.

The foundational Bitcoin blockchain remains unaffected, but after a summer like this, the question lingers. Where do we go from here?

Other headlines this week include

5,000+ attendees.

140+ speakers.

45+ exhibitors.

Two days dedicated to Bitcoin in the heart of America.

The Midwest Bitcoin Summit takes over the Greater Columbus Convention Center September 23-24, bringing together Bitcoiners, builders, investors, policymakers and some of the biggest names in the industry.

Hear from Congressman Warren Davidson, SEC Commissioner Hester Peirce, Avik Roy, Luke Broyles, CJ Konstantinos and many more across Bitcoin mining, investing, self-custody, policy, Austrian economics and enterprise adoption.

Beyond the main stage, you’ll find technical workshops, breakout sessions, a packed expo hall, dedicated networking opportunities and VIP events.

And tickets start at just $50.

If you’ve been waiting to make plans, this is the last call.

Join thousands of Bitcoiners in Columbus next week.

The summer of 2026 has been rough for Bitcoin, and not necessarily because of the price.

The industry has taken hit after hit. We had the Coldcard hack, security issues involving Lightning infrastructure and BTCPay Server, a seemingly endless stream of data breaches affecting hardware wallet providers, and now Revolut disclosing passports, statements, and Bitcoin-related records after falling for a fraudulent government request.

But the big one this week, and probably the one that did the most damage to the ecosystem, was Liquid.

For some context, Liquid is a Bitcoin sidechain designed to enable faster, more private transactions while keeping Bitcoin as the underlying asset.

The network had increasingly been used by wallets such as Aqua and Bull Bitcoin, as well as technology from Breez, to give users a way to preserve self-custody while avoiding some of the complexity of running and managing a Lightning node.

Using swaps under the hood, users could send and receive Lightning payments while ultimately holding their balance in L-BTC. It offered a way to make Bitcoin payments easier without completely giving up self-custody.

Then this week, a group of self-described “white-hat hackers” discovered and exploited a vulnerability that allowed them to withdraw close to 4,000 BTC, roughly 96% of the Bitcoin backing the L-BTC in circulation at the time.

Blockstream responded by sending the hackers a security contact through an OP_RETURN message on-chain. The hackers kept much of the conversation public and said they would return “most of the funds” once the vulnerability was patched.

Ultimately, around 3,400 BTC were returned, meaning the self-appointed white hats effectively kept roughly 15% of what they had taken.

That has understandably divided opinion across the community. How much, if anything, were the hackers entitled to keep for discovering the vulnerability?

There is an argument that the outcome was fair enough. They found a catastrophic bug, exposed it, returned most of the funds, and potentially prevented someone less cooperative from taking everything.

But let’s not kid ourselves. If Blockstream never agreed to that amount as a bounty, then the hackers essentially decided for themselves that taking 15% was acceptable because they could have taken 100%.

That is very different from a bug bounty.

Calling yourself a white hat doesn’t automatically make the amount you choose to keep legitimate compensation for finding a vulnerability.

On the positive side, most of the Bitcoin was returned. The missing funds still leave a hole, but it seems likely that Blockstream and the Liquid Federation will do everything they can to restore the peg fully to 1:1.

Their incentives to do so are obvious, as confidence in the Liquid Network ultimately depends on users believing that one L-BTC can be redeemed for one BTC.

What is harder to shake is the feeling that Bitcoin is going through a period where cybersecurity concerns and macroeconomic volatility are colliding.

On one side, the case for an asset that cannot simply be diluted feels increasingly obvious as governments continue issuing enormous amounts of debt. On the other, it can feel surprisingly difficult to answer what should be a simple question: What is the safest way to hold your Bitcoin?

Is it a hardware wallet, a multi-vendor multisig setup, an ETF, an exchange, or something like Liquid? Every option eliminates certain risks while introducing others.

There is still nothing quite like the sovereignty that comes with having full control over your own Bitcoin. But that sovereignty also means accepting responsibility for the risks that come with it.

Maybe the answer, particularly when the amount at stake becomes significant, is some form of attack-vector diversification: using a combination of tools rather than relying entirely on one.

But I won’t be the one making custody recommendations in times like these. Everyone has to take the time, do their own research, understand the tradeoffs, and find a setup they feel comfortable using to hold their Bitcoin.

For now, much of the infrastructure being built around Bitcoin remains a work in progress. I’m sure the industry will come back stronger from this period. Wallets will improve, vulnerabilities will be patched, infrastructure will become more robust, and AI will increasingly be used to strengthen security.

Bitcoin seems to be reminding us that being your own bank sounds great, but actually being your own bank requires great responsibility.

Let’s keep stacking.
- Bam