Liquid "white hat hacker" says most of the 4,000 BTC will be returned after the vulnerability is fixed.

BlockBeats News, September 7 - Galaxy Research Head Alex Thorn stated that in the recent abnormal fund transfer incident on the Liquid network, the "white hat" attacker is communicating with Blockstream via OP_RETURN on-chain messages and PGP encrypted information, and has indicated that after the Liquid network vulnerability is fixed, they will return "most" of the approximately 4,000 BTC transferred. At block height 965,822, a Blockstream address sent 1,000 satoshis to a related address with a message requesting contact with the Blockstream security team; a subsequent block contained a PGP-encrypted message, verified and signed with Blockstream's public key, showing that a communication channel has been established between the two parties.

Subsequently, at block 965,869, the attacker sent 1,000 satoshis to Blockstream's Peg wallet via a self-transfer transaction, with a message asking, "Is it okay to return most of the funds to the Blockstream address?" The attacker further stated that they need to first fix the vulnerability and ensure all nodes have completed patch upgrades before safely returning the funds after confirming the fix is complete. Additionally, the attacker sent encrypted technical information to Blockstream via PGP that only their team can read.

Previously reported, a suspected white hat hacker withdrew approximately 4,000 BTC, worth about $320 million, from the Liquid Federation wallet via SideSwap PAK (Peg-out Authorization Key).