Liquid promises private transfers backed one-for-one by bitcoin held behind a federated threshold. An incomplete cache key let forged L-BTC pass validation, then ordinary peg-out machinery moved nearly the entire real reserve, exposing failures in cryptographic context, operational release discipline, withdrawal controls, and the claim that seizing $320 million first was the least harmful path.