White-hat hacker says they'll return most of roughly 4,000 BTC taken from Liquid Network after patch

A white-hat actor linked to an unusual transfer on Blockstream's Liquid Network has opened direct lines of communication with Blockstream and says they plan to return "most" of the roughly 4,000 BTC involved once the underlying vulnerability is fixed, according to Huoxing Finance. Galaxy Digital research lead Alex Thorn wrote on Sept. 7 that the party has been coordinating through on-chain OP_RETURN messages as well as PGP-encrypted communications. At block height 965,822, a Blockstream address sent 1,000 satoshis to the relevant address with a note asking the actor to contact Blockstream's security team. A subsequent block included a PGP-encrypted message that was signed and verified using Blockstream's public key, confirming an established channel. At block 965,869, the actor sent 1,000 satoshis to Blockstream's Peg wallet in a self-transfer transaction, asking whether it would be acceptable to return most of the funds to a Blockstream address. The actor said the bug must be patched and all nodes updated first, and that the funds would be returned after the fix is confirmed. The party also provided Blockstream with encrypted technical details via PGP that only Blockstream's team can read. Earlier reports said a suspected white-hat hacker withdrew around 4,000 BTC, worth about $320 million, from the Liquid Federation wallet using the SideSwap PAK (Pegout Authorization Key).