Liquid's white hat hacker says they will return most of the 4000 BTC after the vulnerability is patched.

Galaxy Research Head Alex Thorn stated in a post that the "white hat" attacker behind the abnormal fund transfer incident on the Liquid network is communicating with Blockstream via on-chain OP_RETURN messages and PGP-encrypted communications. The attacker noted that after the Liquid network’s vulnerability is patched, they will return "most" of the roughly 4,000 BTC transferred. At block height 965,822, a Blockstream address sent 1,000 satoshis to a related address with a message requesting contact with Blockstream’s security team. The subsequent block contained a PGP-encrypted message signed with Blockstream’s public key, confirming a communication channel had been established between the two parties. Later, in block 965,869, the attacker sent 1,000 satoshis to Blockstream’s Peg wallet via a self-transfer, asking: "Is it okay to return most of the funds to the Blockstream address?" The attacker further specified that the vulnerability must first be fixed, all nodes must complete the patch upgrade, and funds will be safely returned only after the fix is confirmed. Additionally, the attacker sent PGP-encrypted technical information accessible exclusively to Blockstream’s team. Earlier reports noted that the suspected white hat hacker withdrew approximately 4,000 BTC (valued at around $320 million) from the Liquid Federation wallet via SideSwap PAK (Peg-out Authorization Key).