A Liquid white-hat hacker said most of the 4,000 BTC taken through a Liquid Network vulnerability would be returned after the issue is fixed. The communication with Blockstream used OP_RETURN messages, which attach data to blockchain transactions, and PGP encryption. Blockstream addresses sent 1,000 satoshis in block 965,822 with instructions to contact its security team through the company website. In block 965,865, the hacker sent an encrypted message to the holder's own key with a detached PGP signature verifiable through a key published by Blockstream. The hacker then used self-spend transactions to send 1,000 satoshis to the Liquid federation peg wallet in blocks 965,869 and 965,875. The later message asked Blockstream to repair the vulnerability, ensure every node had installed the patch and confirm completion before the funds were safely returned. Technical details were encrypted to Blockstream's published key and could be read only by Blockstream, according to monitoring by Galaxy's head of research.