White Hat Hacker to Return Most of the 4,000 BTC Stolen from the Liquid Network

According to Huoxing Finance, on September 7, Galaxy research lead Alex Thorn posted that the "white hat" actor behind the unusual fund transfer on the Liquid network is communicating with Blockstream via on-chain OP_RETURN messages and PGP-encrypted communications, stating that after the Liquid network vulnerability is patched, they will return "most" of the approximately 4,000 BTC transferred. At block height 965,822, a Blockstream address sent 1,000 satoshis to the relevant address with a message requesting contact with Blockstream’s security team; the subsequent block contained a PGP-encrypted message, signed and verified using Blockstream’s public key, confirming that a communication channel had been established. Later, at block 965,869, the actor sent 1,000 satoshis to Blockstream’s Peg wallet via a self-transfer transaction, asking: “Would it be acceptable to return most of the funds to a Blockstream address?” The actor further indicated that the vulnerability must first be patched and all nodes updated before the funds are safely returned upon confirmation of the fix. Additionally, the actor sent Blockstream encrypted technical information via PGP, readable only by their team. Previously, it was reported that a suspected white-hat hacker withdrew approximately 4,000 BTC—valued at around $320 million—from the Liquid Federation wallet using the SideSwap PAK (Peg-out Authorization Key).