Liquid 'White Hat Hacker' Says Will Return Most of 4,000 BTC After Vulnerability Fix

On September 7, Galaxy Research Head Alex Thorn stated that the 'white hat' attacker in the abnormal fund transfer incident on the Liquid network is communicating with Blockstream via OP_RETURN on-chain messages and PGP-encrypted information, and has indicated that after the Liquid network vulnerability is fully fixed, they will return 'most' of the approximately 4,000 BTC transferred. At block height 965,822, an address from Blockstream sent 1,000 satoshis to a related address with a message requesting contact with the Blockstream security team; a subsequent block contained a PGP-encrypted message, verified and signed with Blockstream's public key, showing that a communication channel has been established between both parties.

Subsequently, at block 965,869, the attacker sent 1,000 satoshis to Blockstream's Peg wallet via a self-transfer transaction, with a message asking, 'Is it okay to return most of the funds to the Blockstream address?' The attacker further stated that the vulnerability must first be fixed, and all nodes must complete patch upgrades, before safely returning the funds upon confirmed completion of the fix. Additionally, the attacker sent Blockstream encrypted technical information via PGP, readable only by their team. Previously reported, a suspected white hat hacker withdrew approximately 4,000 BTC, worth about $320 million, from the Liquid Federation wallet via the SideSwap PAK (Peg-out Authorization Key).

[BlockBeats]