BlockBeats News, September 7 - Galaxy's Head of Research stated that in the abnormal fund transfer incident on the Liquid network, the "white hat" attacker is communicating with Blockstream via OP_RETURN on-chain messages and PGP encrypted information, and indicated that after the vulnerability in the Liquid network is fixed, they will return "most" of the approximately 4,000 BTC transferred. At block height 965,822, a Blockstream address sent 1,000 satoshis to a related address with a message requesting contact with the Blockstream security team; a subsequent block contained a PGP-encrypted message verified by Blockstream's public key, showing that a communication channel has been established between the two parties.

Later, at block 965,869, the attacker sent 1,000 satoshis to Blockstream's Peg wallet via a self-transfer transaction, with a message asking, "Is it okay to return most of the funds to the Blockstream address?" Following this, the attacker further stated that the vulnerability needs to be fixed first, and all nodes must be fully patched before safely returning the funds after confirming the fix is complete. Additionally, the attacker sent encrypted technical information via PGP to Blockstream that only their team can read.

Previously reported, a suspected white hat hacker withdrew approximately 4,000 BTC, worth about $320 million, from the Liquid Federation wallet via the SideSwap PAK (Peg-out Authorization Key).